PT-2024-36009 · Unknown · Dependency-Track

Hannes Michel · Published 2024-12-04 · Updated 2024-12-05 · CVE-2024-54002

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.12.2

Description: The issue allows actors to enumerate valid names of managed users by leveraging the observable difference in request duration when performing a login request against the "/api/v1/user/login" endpoint with a username that exists in the system versus one that does not. This can be done by measuring the time it takes to process a login request with an existing username versus a non-existing one. LDAP and OpenID Connect users are not affected.

Recommendations: For versions prior to 4.12.2, update to Dependency-Track 4.12.2 to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v1/user/login" endpoint to minimize the risk of exploitation. Avoid using this endpoint for login requests until the issue is resolved.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2024-54002

GHSA-9W3M-HM36-W32W

Affected Products

Dependency-Track

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54002.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-54002 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54002 · Vendor Advisory
• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9w3m-hm36-w32w · Note
• https://twitter.com/VulmonFeeds/status/1864471003176239342 · Twitter Post
• https://twitter.com/CVEnew/status/1864336592602538362 · Twitter Post
• https://t.me/cvedetector/12012 · Telegram Post