CVE-2024-51720 - Vulnerability Details

Vendors	Products
Blackberry	Secusuite

Link	Providers
https://support.blackberry.com/pkb/s/article/140220

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses		CWE-307

Type	Values Removed	Values Added
Description		An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.
Title		Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
References		https://support.blackberry.com/pkb/s/article/140220
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51720", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "state": "PUBLISHED", "assignerShortName": "blackberry", "dateReserved": "2024-10-30T17:19:06.485Z", "datePublished": "2024-11-12T18:01:49.411Z", "dateUpdated": "2024-11-12T21:38:39.845Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["SecuSUITE Secure Client Authentication"], "product": "SecuSUITE", "vendor": "BlackBerry", "versions": [{"status": "affected", "version": "5.0.420"}]}], "datePublic": "2024-11-12T17:35:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\">n insufficient entropy vul</span><span style=\"background-color: rgb(255, 255, 255);\">nerability </span><span style=\"background-color: rgb(255, 255, 255);\">in the </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span> <span style=\"background-color: rgb(255, 255, 255);\">Secure Client Authentication (SCA) Server </span><span style=\"background-color: rgb(255, 255, 255);\">of </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\"> 5.</span><span style=\"background-color: rgb(255, 255, 255);\">0.420 and earlie</span><span style=\"background-color: rgb(255, 255, 255);\">r could allow an </span><span style=\"background-color: rgb(255, 255, 255);\">attacker to potentially </span><span style=\"background-color: rgb(255, 255, 255);\">enroll an attacker-controlled device to the victim\u2019s account and telephone number.</span>&nbsp;"}], "value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number."}], "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2024-11-12T18:42:07.932Z"}, "references": [{"url": "https://support.blackberry.com/pkb/s/article/140220"}], "source": {"discovery": "UNKNOWN"}, "title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-12T21:38:30.257463Z", "id": "CVE-2024-51720", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T21:38:39.845Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-51720 (string)

assignerOrgId : dbe78b00-5e7b-4fda-8748-329789ecfc5c (string)

state : PUBLISHED (string)

assignerShortName : blackberry (string)

dateReserved : 2024-10-30T17:19:06.485Z (string)

datePublished : 2024-11-12T18:01:49.411Z (string)

dateUpdated : 2024-11-12T21:38:39.845Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : SecuSUITE Secure Client Authentication (string)

]

product : SecuSUITE (string)

vendor : BlackBerry (string)

versions : [ »

0 : { »

status : affected (string)

version : 5.0.420 (string)

}

]

}

]

datePublic : 2024-11-12T17:35:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.  (string)

}

]

value : An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-49 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-49 Password Brute Forcing (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-307 (string)

description : CWE-307 Improper Restriction of Excessive Authentication Attempts (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : dbe78b00-5e7b-4fda-8748-329789ecfc5c (string)

shortName : blackberry (string)

dateUpdated : 2024-11-12T18:42:07.932Z (string)

}

references : [ »

0 : { »

url : https://support.blackberry.com/pkb/s/article/140220 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-12T21:38:30.257463Z (string)

id : CVE-2024-51720 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-12T21:38:39.845Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-51720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-12T21:38:30.257463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T21:38:36.144Z"}}], "cna": {"title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BlackBerry", "modules": ["SecuSUITE Secure Client Authentication"], "product": "SecuSUITE", "versions": [{"status": "affected", "version": "5.0.420"}], "defaultStatus": "unaffected"}], "datePublic": "2024-11-12T17:35:00.000Z", "references": [{"url": "https://support.blackberry.com/pkb/s/article/140220"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\">n insufficient entropy vul</span><span style=\"background-color: rgb(255, 255, 255);\">nerability </span><span style=\"background-color: rgb(255, 255, 255);\">in the </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span> <span style=\"background-color: rgb(255, 255, 255);\">Secure Client Authentication (SCA) Server </span><span style=\"background-color: rgb(255, 255, 255);\">of </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\"> 5.</span><span style=\"background-color: rgb(255, 255, 255);\">0.420 and earlie</span><span style=\"background-color: rgb(255, 255, 255);\">r could allow an </span><span style=\"background-color: rgb(255, 255, 255);\">attacker to potentially </span><span style=\"background-color: rgb(255, 255, 255);\">enroll an attacker-controlled device to the victim\u2019s account and telephone number.</span>&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2024-11-12T18:42:07.932Z"}}}, "cveMetadata": {"cveId": "CVE-2024-51720", "state": "PUBLISHED", "dateUpdated": "2024-11-12T21:38:39.845Z", "dateReserved": "2024-10-30T17:19:06.485Z", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "datePublished": "2024-11-12T18:01:49.411Z", "assignerShortName": "blackberry"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-51720 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-12T21:38:30.257463Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-12T21:38:36.144Z (string)

}

]

cna : { »

title : Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (string)

source : { »

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-49 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-49 Password Brute Forcing (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.8 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : BlackBerry (string)

modules : [ »

0 : SecuSUITE Secure Client Authentication (string)

]

product : SecuSUITE (string)

versions : [ »

0 : { »

status : affected (string)

version : 5.0.420 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-11-12T17:35:00.000Z (string)

references : [ »

0 : { »

url : https://support.blackberry.com/pkb/s/article/140220 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.  (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-307 (string)

description : CWE-307 Improper Restriction of Excessive Authentication Attempts (string)

}

]

}

]

providerMetadata : { »

orgId : dbe78b00-5e7b-4fda-8748-329789ecfc5c (string)

shortName : blackberry (string)

dateUpdated : 2024-11-12T18:42:07.932Z (string)

}

cveMetadata : { »

cveId : CVE-2024-51720 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-12T21:38:39.845Z (string)

dateReserved : 2024-10-30T17:19:06.485Z (string)

assignerOrgId : dbe78b00-5e7b-4fda-8748-329789ecfc5c (string)

datePublished : 2024-11-12T18:01:49.411Z (string)

assignerShortName : blackberry (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number."}, {"lang": "es", "value": "Una vulnerabilidad de entrop\u00eda insuficiente en SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE de las versiones 5.0.420 y anteriores, podr\u00eda permitir que un atacante registre potencialmente un dispositivo controlado por el atacante en la cuenta y el n\u00famero de tel\u00e9fono de la v\u00edctima."}], "id": "CVE-2024-51720", "lastModified": "2024-11-13T17:01:58.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "secure@blackberry.com", "type": "Secondary"}]}, "published": "2024-11-12T18:15:46.693", "references": [{"source": "secure@blackberry.com", "url": "https://support.blackberry.com/pkb/s/article/140220"}], "sourceIdentifier": "secure@blackberry.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "secure@blackberry.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de entropía insuficiente en SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE de las versiones 5.0.420 y anteriores, podría permitir que un atacante registre potencialmente un dispositivo controlado por el atacante en la cuenta y el número de teléfono de la víctima. (string)

}

]

id : CVE-2024-51720 (string)

lastModified : 2024-11-13T17:01:58.603 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 2.5 (number)

source : secure@blackberry.com (string)

type : Secondary (string)

}

]

}

published : 2024-11-12T18:15:46.693 (string)

references : [ »

0 : { »

source : secure@blackberry.com (string)

url : https://support.blackberry.com/pkb/s/article/140220 (string)

}

]

sourceIdentifier : secure@blackberry.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-307 (string)

}

]

source : secure@blackberry.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object