Autopass License Server CVE-2024-51767

The CVSS 3.1 score of 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates a HIGH-severity vulnerability with multiple concerning characteristics: (1) Network-accessible attack vector requiring no special conditions, (2) Low attack complexity with no prerequisites, (3) No privilege or user interaction required, enabling full automation. The authentication bypass classification (CWE-287) is inherently high-risk as it directly undermines the security boundary. While confidentiality, integrity, and availability impacts are rated as Low individually, the combination of trivial exploitability with direct authentication bypass suggests attackers could enumerate or modify license data, potentially leading to license fraud or service disruption. This is a HIGH real-world priority requiring immediate patching, particularly for organizations with internet-facing APLS deployments. The absence of reported mitigating factors (no mention of narrow applicability or rare configurations) elevates the baseline risk.

An unauthenticated attacker on the network identifies an HPE AutoPass License Server instance (versions <9.17) accessible over the internet or internal network. The attacker crafts HTTP/HTTPS requests to the APLS API or web interface, exploiting the authentication bypass flaw to gain unauthorized access without providing valid credentials. Once authenticated, the attacker could: (1) retrieve sensitive license data and customer information, (2) modify license allocations to enable unlicensed software usage, (3) revoke or transfer licenses maliciously, or (4) trigger license server denial-of-service conditions. Due to the low attack complexity and lack of user interaction required, this exploitation could be fully automated and incorporated into opportunistic scanning tools, making it likely to be discovered and leveraged quickly by threat actors targeting software supply chains or seeking to circumvent licensing controls. No special tools or deep technical knowledge are required—a simple curl command or HTTP client could exploit this vulnerability.