CVE-2024-4332: Fortra Tripwire Enterprise, заобикаляне на вход и права

Описание

Оригинално описание

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.

Засегнати продукти

• Fortra Tripwire Enterprise: 9.1.0
• fortra tripwire_enterprise: 9.1.0

Вид слабост

• CWE-303 Неправилна имплементация на алгоритъм за автентикация
• CWE-306 Липсваща автентикация за критична функционалност

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-4332
• https://nvd.nist.gov/vuln/detail/CVE-2024-4332
• https://www.fortra.com/security/advisory/fi-2024-006