Cyber Resilience

CVE-2024-1621

High

Published: 02 September 2024

Published
02 September 2024
Modified
17 September 2024
KEV Added
Patch
CVSS Score v4 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 55.3th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-1621 is a high-severity Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Nt-Ware Uniflow Online. Its CVSS base score is 8.3 (High).

Operationally, ranked in the top 44.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are…

more

impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nt-ware
uniflow online
all versions · ≤ 2024.1.0
nt-ware
uniflow online print \& scan
all versions
nt-ware
uniflow smartclient
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-940

Enforces verification of the source of a communication channel by requiring identification and authentication of services first.

addresses: CWE-940

Requires explicit verification of the source and integrity of the channel used for authentication and other security functions.

addresses: CWE-940

Provides the means to verify the source of name-resolution responses instead of relying on unauthenticated channels.

addresses: CWE-940

Requires explicit verification of the communication source, blocking session hijacking via spoofed or alternate channels.

References