CVE-2024-48952

CVSS 6.4 MEDIUMEPSS 0.3%CWE-306

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.4EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

07 nov 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Productos afectados

n/a · n/a

Referencias

https://docs.logpoint.com/docs/whats-new-in-logpoint/en/latest/https://servicedesk.logpoint.com/hc/en-us/articles/21968950913693-Static-JWT-Key-enables-unauthorized-API-access https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security