CVE-2024-45369

CRITICAL

Improper Authentication (CWE-287)

2024-11-22 ics-cert@hq.dhs.gov

Authentication Bypass

9.2

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Nov 22, 2024 - 23:15 cve.org

CRITICAL 9.2

DescriptionCVE.org

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

AnalysisAI

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.