CVE-2024-45488
Published: 30 August 2024
Summary
CVE-2024-45488 is a critical-severity an unspecified weakness vulnerability in Oneidentity (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
One Identity Safeguard for Privileged Passwords before 7.5.2 is affected by a vulnerability that allows unauthorized access due to an issue related to cookies. The flaw is limited to virtual appliance installations on VMware or Hyper-V platforms and carries a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can exploit the weakness over the network without any privileges or user interaction to obtain unauthorized access, resulting in full compromise of confidentiality, integrity, and availability on the affected appliance.
Vendor advisories direct customers to apply the fixed releases 7.0.5.1 LTS, 7.4.2, or 7.5.2; detailed guidance is provided in the referenced One Identity knowledge-base articles.
The associated EPSS score stands at 0.8686 with an identical peak value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-41507
Vulnerability details
One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations (VMware or HyperV). The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.