What is CVE-2024-45164?

CVE-2024-45164 is a high-severity vulnerability in Akamai Secure Internet Access Enterprise Threatavert, classified under Incorrect Authorization. CVSS score: 7.1/10. Published 2024-11-04.

How severe is CVE-2024-45164?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Akamai Secure Internet Access Enterprise Threatavert

CVE-2024-45164

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.

Vulnerability class: Broken Access Control

EPSS: 0.003 (23.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Affected products

Akamai Secure_internet_access_enterprise_threatavert — versions 19.2.0.2
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2024-45164?: CVE-2024-45164 is a high-severity vulnerability in Akamai Secure Internet Access Enterprise Threatavert, classified under Incorrect Authorization. CVSS score: 7.1/10. Published 2024-11-04.
How severe is CVE-2024-45164?: High severity. CVSS v3 base score is 7.1 out of 10.