CVE-2024-38371 (GCVE-0-2024-38371)
Vulnerability from cvelistv5 – Published: 2024-06-28 17:58 – Updated: 2024-08-02 04:04
VLAI?
Title
Insufficient access control for OAuth2 Device Code flow in authentik
Summary
authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.
Severity ?
8.6 (High)
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| goauthentik | authentik |
Affected:
< 2024.6.0
Affected: < 2024.4.3 Affected: < 2024.2.4 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "authentik",
"vendor": "goauthentik",
"versions": [
{
"lessThan": "2024.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2024.4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2024.2.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T20:07:42.936032Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T20:10:55.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:25.257Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "authentik",
"vendor": "goauthentik",
"versions": [
{
"status": "affected",
"version": "\u003c 2024.6.0"
},
{
"status": "affected",
"version": "\u003c 2024.4.3"
},
{
"status": "affected",
"version": "\u003c 2024.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T17:58:48.169Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0"
}
],
"source": {
"advisory": "GHSA-jq3m-37m7-gp45",
"discovery": "UNKNOWN"
},
"title": "Insufficient access control for OAuth2 Device Code flow in authentik"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-38371",
"datePublished": "2024-06-28T17:58:48.169Z",
"dateReserved": "2024-06-14T14:16:16.466Z",
"dateUpdated": "2024-08-02T04:04:25.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38371\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-28T20:07:42.936032Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\"], \"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2024.6.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2024.4.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2024.2.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-28T20:10:51.361Z\"}}], \"cna\": {\"title\": \"Insufficient access control for OAuth2 Device Code flow in authentik\", \"source\": {\"advisory\": \"GHSA-jq3m-37m7-gp45\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2024.6.0\"}, {\"status\": \"affected\", \"version\": \"\u003c 2024.4.3\"}, {\"status\": \"affected\", \"version\": \"\u003c 2024.2.4\"}]}], \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-06-28T17:58:48.169Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-38371\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-06-28T20:10:55.919Z\", \"dateReserved\": \"2024-06-14T14:16:16.466Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-06-28T17:58:48.169Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…