THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4332

Improper Authentication in Tripwire Enterprise 9.1.0 APIs

Reserved:2024-04-29
Published:2024-06-03
Updated:2024-06-07

Description

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.



CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Red

Problem types

CWE-303 Incorrect Implementation of Authentication Algorithm

Product status

Default status
unaffected

9.1.0
affected

References

https://www.fortra.com/security/advisory/fi-2024-006

cve.org CVE-2024-4332

nvd.nist.gov CVE-2024-4332

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4332