PT-2024-34700 · Wave · Wave

Mohit Gadiya · Published 2024-11-04 · Updated 2024-11-08 · CVE-2024-51557

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wave 2.0

Description This issue exists due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this by sending multiple OTP requests through the vulnerable API endpoint, leading to OTP bombing or flooding on the targeted system. The vulnerability is related to improper control of interaction frequency.

Recommendations For Wave 2.0, patch to the latest version as soon as possible and monitor for suspicious activity. As a temporary workaround, consider restricting access to the vulnerable API endpoint to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-799

CWE-770

Related Identifiers

CVE-2024-51557

Affected Products

Wave

References · 8

• https://osv.dev/vulnerability/CVE-2024-51557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51557 · Security Note
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 · Note
• https://twitter.com/VulmonFeeds/status/1853525601765695985 · Twitter Post
• https://twitter.com/oktsec/status/1853431426714124543 · Twitter Post
• https://t.me/cvedetector/9726 · Telegram Post
• https://t.me/latest_high_impact_cve/1449 · Telegram Post
• https://twitter.com/CVEnew/status/1853414866633007283 · Twitter Post