PT-2024-32713 · Unknown · Shilpi Client Dashboard

Mohit Gadiya · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-47654

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Shilpi Client Dashboard versions prior to 9.7.0

Description This issue exists due to a lack of rate limiting and Captcha protection for OTP requests in certain API endpoints. An unauthenticated remote attacker could exploit this by sending multiple OTP requests through vulnerable API endpoints, leading to OTP bombing on the targeted system. The attacker could flood requests, degrading performance.

Recommendations For versions prior to 9.7.0, update to version 9.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints to minimize the risk of exploitation. Avoid using the OTP request feature in the affected API endpoints until the issue is resolved.

Fix

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2024-47654

Affected Products

Shilpi Client Dashboard

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-47654 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47654 · Vendor Advisory
• https://twitter.com/oktsec/status/1842212532733223162 · Twitter Post
• https://t.me/cvenotify/98300 · Telegram Post
• https://twitter.com/CVEnew/status/1842180449264963670 · Twitter Post
• https://t.me/cvedetector/6981 · Telegram Post
• https://t.me/latest_high_impact_cve/1250 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842219662337098190 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313 · Note