CVE-2024-55008

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55008
JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrect login attempts every minute, the attacker can trigger the account lockout mechanism on the account level, effectively locking the user out indefinitely. Since the lockout is applied to the user account and not based on the IP address, any attacker can trigger the lockout on any user account, regardless of their privileges.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://jatos.com Product
https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f Exploit Third Party Advisory
https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jatos:jatos:3.9.4:*:*:*:*:*:*:*
History

24 Jun 2025, 00:19

Type Values Removed Values Added
References () http://jatos.com - () http://jatos.com - Product
References () https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f - () https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f - Exploit, Third Party Advisory
CPE cpe:2.3:a:jatos:jatos:3.9.4:*:*:*:*:*:*:*
First Time Jatos
Jatos jatos

08 Jan 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) JATOS 3.9.4 contiene una vulnerabilidad de denegación de servicio (DoS) en el sistema de autenticación, donde un atacante puede evitar que usuarios legítimos accedan a sus cuentas al enviar repetidamente múltiples intentos de inicio de sesión fallidos. En concreto, al enviar 3 intentos de inicio de sesión incorrectos cada minuto, el atacante puede activar el mecanismo de bloqueo de cuenta a nivel de cuenta, bloqueando efectivamente al usuario de forma indefinida. Dado que el bloqueo se aplica a la cuenta de usuario y no se basa en la dirección IP, cualquier atacante puede activar el bloqueo en cualquier cuenta de usuario, independientemente de sus privilegios.
CWE CWE-307
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f - () https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f -

07 Jan 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-07 16:15

Updated : 2025-06-24 00:19

NVD link : CVE-2024-55008

Mitre link : CVE-2024-55008

CVE.ORG link : CVE-2024-55008

JSON object : View

Products Affected

jatos

  • jatos
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts