PT-2024-3950 · Logpoint · Logpoint Saml Authentication

Rushmi Bhuju · Published 2024-05-27 · Updated 2024-11-04 · CVE-2024-36383

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Logpoint SAML Authentication versions prior to 6.0.3

Description An issue in Logpoint SAML Authentication allows an attacker to place a crafted filename in the state field of a SAML SSO-URL response. This can lead to the deletion of the file corresponding to the crafted filename, resulting in a SAML Authentication login outage. The vulnerability is related to incorrect external management of a filename or path. Exploitation can allow a remote attacker to delete arbitrary files and cause authentication failures.

Recommendations For versions prior to 6.0.3, update to version 6.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the SAML SSO-URL response to minimize the risk of exploitation. Avoid using crafted filenames in the state field of the SAML SSO-URL response until the issue is resolved.

Fix

Weakness Enumeration

CWE-73

CWE-706

Related Identifiers

BDU:2024-04362

CVE-2024-36383

Affected Products

Logpoint Saml Authentication

References · 6

• https://bdu.fstec.ru/vul/2024-04362 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36383 · Vendor Advisory
• https://servicedesk.logpoint.com/hc/en-us/articles/19128172110621-Arbitrary-file-deletion-through-URL-Injection-to-SAML-SSO-URL-Response · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36383 · Security Note
• https://t.me/cvenotify/81079 · Telegram Post
• https://t.me/pentestingnews/47578 · Telegram Post