Authentication Bypass Vulnerability in Internet2 Grouper Before 5.6
CVE-2024-39848

9.1CRITICAL

Key Information:

Vendor

Internet2

Status
Grouper
Vendor
CVE Published:
29 June 2024

What is CVE-2024-39848?

The vulnerability in Internet2 Grouper allows unauthorized access due to improper handling of LDAP authentication protocols. It specifically affects configurations utilizing the UyY29r password for the M3vwHr account, enabling potential bypass of security measures. This flaw also impacts 'Grouper for Web Services', creating significant security risks for users running older versions.

References

https://spaces.at.internet2.edu/display/Grouper/Grouper+b...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.