PT-2024-33490 · Autolab · Autolab

Henryhuang2004 · Published 2024-10-25 · Updated 2024-11-14 · CVE-2024-49376

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autolab version 3.0.0

Description The issue concerns misconfigured reset password permissions for email-based accounts. Users with insufficient privileges could reset and potentially access privileged users' accounts by resetting their passwords.

Recommendations For version 3.0.0, update to version 3.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the password reset feature until the update is applied.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2024-49376

GHSA-V46J-H43H-RWRM

Affected Products

Autolab

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49376.json · Exploit
• https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm · Vendor Advisory
• https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-49376 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v46j-h43h-rwrm · Vendor Advisory
• https://github.com/autolab/Autolab · Note
• https://t.me/cvedetector/8944 · Telegram Post
• https://t.me/cvenotify/101769 · Telegram Post
• https://t.me/cvenotify/99500 · Telegram Post
• https://t.me/cvenotify/99732 · Telegram Post