PT-2024-34705 · Aero · Aero

Mohit Gadiya · Published 2024-11-04 · Updated 2024-11-06 · CVE-2024-51561

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Aero (affected versions not specified)

Description This issue exists due to improper implementation of the OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this by intercepting and manipulating responses during the second factor authentication process. Successful exploitation could allow the attacker to bypass OTP verification for accessing other user accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2024-51561

Affected Products

Aero

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-51561 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51561 · Vendor Advisory
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 · Note
• https://twitter.com/CVEnew/status/1853422943386145107 · Twitter Post
• https://twitter.com/CveFindCom/status/1853422251493695761 · Twitter Post
• https://t.me/cvedetector/9730 · Telegram Post
• https://t.me/latest_high_impact_cve/1450 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853535841546580032 · Twitter Post