CVE-2024-0454

{"id": "CVE-2024-0454", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "published": "2024-01-12T02:15:44.867", "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy", "tags": ["Not Applicable"], "source": "36106deb-8e95-420b-a0a0-e70af5d245df"}, {"url": "https://github.com/advisories/GHSA-w3jx-33qh-77f8", "tags": ["Third Party Advisory"], "source": "nvd@nist.gov"}, {"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "description": [{"lang": "en", "value": "CWE-290"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."}, {"lang": "es", "value": "La soluci\u00f3n ELAN Match-on-Chip FPR tiene un error de dise\u00f1o sobre el riesgo potencial de fuga de SID v\u00e1lido y enumeraci\u00f3n con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una p\u00e9rdida de identidad de la cuenta. La versi\u00f3n inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufrir\u00eda este riesgo en la plataforma DELL Inspiron."}], "lastModified": "2024-11-21T08:46:37.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D3B550F-D100-4116-AE9F-7F9F203F7B0F"}, {"criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BD8D8C7-1B4D-4452-8BC2-6D2B05939AC1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "02144756-1716-40FF-884B-3E4DD9D2C0A3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "36106deb-8e95-420b-a0a0-e70af5d245df"}