PT-2024-31768 · Reedos · Reedos Aim-Star

Mohit Gadiya · Published 2024-09-11 · Updated 2024-09-18 · CVE-2024-45788

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Reedos aiM-Star version 2.0.1

Description: This issue exists due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this by sending multiple OTP requests through vulnerable API endpoints, leading to OTP bombing/flooding on the targeted system.

Recommendations: For Reedos aiM-Star version 2.0.1, consider implementing rate limiting on OTP requests in the affected API endpoints as a temporary workaround until a patch is available. Restrict access to the vulnerable API endpoints to minimize the risk of exploitation. Avoid using the vulnerable API endpoints for OTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2024-45788

Affected Products

Reedos Aim-Star

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-45788 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45788 · Vendor Advisory
• https://t.me/cvenotify/94145 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833880713742950898 · Twitter Post
• https://twitter.com/CVEnew/status/1833845374592979311 · Twitter Post
• https://t.me/cvenotify/95150 · Telegram Post
• https://t.me/cvedetector/5344 · Telegram Post
• https://twitter.com/CveFindCom/status/1833846149108662724 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291 · Note