CVE-2021-38299

Опубликовано: 27 сент. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

Ссылки

https://github.com/web-auth/webauthn-framework/releases
Release Notes
Third Party Advisory
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/
Third Party Advisory
https://github.com/web-auth/webauthn-framework/releases
Release Notes
Third Party Advisory
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:spomky-labs:webauthn_framwork:*:*:*:*:*:*:*:*

Версия до 3.2.9 (исключая)

cpe:2.3:a:spomky-labs:webauthn_framwork:*:*:*:*:*:*:*:*

Версия от 3.3.0 (включая) до 3.3.4 (исключая)

EPSS

Процентиль: 57%

0.00349

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-6whf-q6p5-84wg