Auth bypass in Lif-Platforms Lif-Auth-Server
CVE-2024-47768
Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacker knew the email of the target, they could supply the email and immediately prompt the server to update the password without ever needing the code. This issue has been patched in version 1.7.3.
Vulnerability class: Broken Authentication
EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lif-platforms Lif-auth-server — versions < 1.7.3
- Lifplatforms Lif_authentication_server
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-47768?
- CVE-2024-47768 is a high-severity vulnerability in Lif-Platforms Lif-Auth-Server, classified under Improper Authentication. CVSS score: 8.1/10. Published 2024-10-04.
- How severe is CVE-2024-47768?
- High severity. CVSS v3 base score is 8.1 out of 10.