OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available.
Metrics
Affected Vendors & Products
References
History
Thu, 12 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 11 Dec 2024 22:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available. | |
Title | OpenCTI's lack of Rate Limit lead to OTP brute forcing | |
Weaknesses | CWE-287 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-12-11T22:01:46.667Z
Updated: 2024-12-12T16:36:11.908Z
Reserved: 2024-08-28T20:21:32.804Z
Link: CVE-2024-45404
Vulnrichment
Updated: 2024-12-12T16:36:07.039Z
NVD
Status : Awaiting Analysis
Published: 2024-12-12T02:02:09.530
Modified: 2024-12-12T17:15:10.350
Link: CVE-2024-45404
Redhat
No data.