Lucene search

CERT-InCVELIST:CVE-2024-47088

HistorySep 19, 2024 - 6:13 a.m.

CVE-2024-47088 User Enumeration vulnerability

2024-09-1906:13:40

CWE-307

CERT-In

www.cve.org

cve-2024-47088

user enumeration

apex softcell ld geo

api based login

brute force

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:L/VI:H/SI:N/VA:N/SA:N

EPSS

0.001

Percentile

39.6%

JSON

This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "LD Geo",
    "vendor": "Apex Softcell",
    "versions": [
      {
        "status": "affected",
        "version": "<4.0.0.7"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:L/VI:H/SI:N/VA:N/SA:N

EPSS

0.001

Percentile

39.6%

JSON

Related for CVELIST:CVE-2024-47088