CVE-2024-47086

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47086
This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API response. Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for other user accounts.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apexsoftcell:ld_geo:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:apexsoftcell:ld_dp_back_office:*:*:*:*:*:*:*:*
History

26 Sep 2024, 15:29

Type Values Removed Values Added
References () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296 - () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296 - Third Party Advisory
CWE NVD-CWE-Other
First Time Apexsoftcell ld Geo
Apexsoftcell ld Dp Back Office
Apexsoftcell
CPE cpe:2.3:a:apexsoftcell:ld_dp_back_office:*:*:*:*:*:*:*:*
cpe:2.3:a:apexsoftcell:ld_geo:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

20 Sep 2024, 12:30

Type Values Removed Values Added
Summary
  • (es) Esta vulnerabilidad existe en Apex Softcell LD DP Back Office debido a la implementación incorrecta del mecanismo de validación OTP en ciertos endpoints de API. Un atacante remoto autenticado podría aprovechar esta vulnerabilidad proporcionando un valor OTP arbitrario para la autenticación y, posteriormente, modificando su respuesta de API. La explotación exitosa de esta vulnerabilidad podría permitir al atacante eludir la verificación OTP para otras cuentas de usuario.

19 Sep 2024, 07:15

Type Values Removed Values Added
Summary (en) This vulnerability exists in LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API response. Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for other user accounts. (en) This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API response. Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for other user accounts.

19 Sep 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-19 06:15

Updated : 2024-09-26 15:29

NVD link : CVE-2024-47086

Mitre link : CVE-2024-47086

CVE.ORG link : CVE-2024-47086

JSON object : View

Products Affected

apexsoftcell

  • ld_geo
  • ld_dp_back_office
CWE
NVD-CWE-Other CWE-302

Authentication Bypass by Assumed-Immutable Data