PT-2024-32806 · Unknown · Lif Authentication Server

Superior126 · Published 2024-10-04 · Updated 2024-11-13 · CVE-2024-47768

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lif Authentication Server versions prior to 1.7.3

Description The issue is related to the account recovery system of the Lif Authentication Server, where there is no check to ensure the user has received the recovery email and entered the correct code. An attacker who knows the target's email can supply the email and prompt the server to update the password without needing the code.

Recommendations For versions prior to 1.7.3, update to version 1.7.3 to resolve the issue. As a temporary workaround, consider restricting access to the account recovery system until the patch is applied.

Exploit

Fix

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-287

CWE-862

Related Identifiers

CVE-2024-47768

GHSA-HMV6-8FG8-7M6F

Affected Products

Lif Authentication Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47768.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47768 · Vendor Advisory
• https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-hmv6-8fg8-7m6f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47768 · Security Note
• https://github.com/Lif-Platforms/Lif-Auth-Server/commit/8dbd7cad914a8b939451c652bfb716aa796f754e · Patch
• https://twitter.com/CVEnew/status/1842215951766347879 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1842244012289269787 · Twitter Post
• https://t.me/cvenotify/101530 · Telegram Post
• https://t.me/cvedetector/6990 · Telegram Post