VulnerabilityDeferred

CVE-2024-12056

By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment.

LOW 2.3EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-358
Source: 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932

References

https://www.pcvue.com/security/security/#SB2024-4

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.