CVE-2024-12838CWE-302

Changing Information Technology CGFIDO - Authentication Bypass

High · published December 31, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00762 · 54.9th percentile
Weakness
CWE-302 · Authentication Bypass by Assumed-Immutable Data
Published
2024-12-31T01:24Z
EPSS history
Timeline
  • 31 DEC 01:24Z
    Changing Information Technology CGFIDO - Authentication Bypass
    cvelistv5