CVE-2023-44039: Critical severity veridiumid vulnerability
Published Apr 3, 2024
·Updated
In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.
Affected Software
2 affected components
Veridium VeridiumID<3.5.0
VeridiumID VeridiumAD<3.5.0
Event History
Apr 3, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-44039?
CVE-2023-44039 has been classified with a high severity due to the potential for account takeover.
2
How do I fix CVE-2023-44039?
To fix CVE-2023-44039, update VeridiumID to version 3.5.0 or later.
3
Who is affected by CVE-2023-44039?
CVE-2023-44039 affects users of VeridiumID versions prior to 3.5.0.
4
What type of attack does CVE-2023-44039 involve?
CVE-2023-44039 involves an internal unauthenticated attacker registering a FIDO authenticator to a victim’s account.
5
What is the impact of CVE-2023-44039?
The impact of CVE-2023-44039 is the potential unauthorized access and account takeover.