What is CVE-2024-54002?

CVE-2024-54002 is a medium-severity vulnerability in Dependencytrack Dependency-Track, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2024-12-04.

How severe is CVE-2024-54002?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Dependencytrack Dependency-Track

CVE-2024-54002

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username that is not known by the system. The observable difference in request duration can be leveraged by actors to enumerate valid names of managed users. LDAP and OpenID Connect users are not affected. The issue has been fixed in Dependency-Track 4.12.2.

EPSS: 0.003 (22.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Dependencytrack Dependency-track — versions < 4.12.2

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2024-54002?: CVE-2024-54002 is a medium-severity vulnerability in Dependencytrack Dependency-Track, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2024-12-04.
How severe is CVE-2024-54002?: Medium severity. CVSS v3 base score is 5.3 out of 10.