CVE-2024-21637

Опубликовано: 11 янв. 2024

Источник: nvd

CVSS3: 7.6

CVSS3: 5.4

EPSS Низкий

Описание

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response_mode=form_post. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.

Ссылки

https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6
Patch
https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6
Patch
https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3j
Mitigation
Third Party Advisory
https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6
Patch
https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6
Patch
https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3j
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*

Версия от 2023.8.0 (включая) до 2023.8.6 (исключая)

cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*

Версия от 2023.10.0 (включая) до 2023.10.6 (исключая)

EPSS

Процентиль: 38%

0.00164

Низкий

7.6 High

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

EPSS

Процентиль: 38%

0.00164

Низкий

7.6 High

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79