CVE-2024-39848: Critical severity grouper vulnerability
Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the M3vwHr account. This also affects "Grouper for Web Services" before 4.13.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39848?
CVE-2024-39848 is considered a moderate severity vulnerability due to its potential for authentication bypass.
How do I fix CVE-2024-39848?
To fix CVE-2024-39848, upgrade Internet2 Grouper to version 5.6 or later and ensure proper LDAP authentication configurations.
What systems are affected by CVE-2024-39848?
CVE-2024-39848 affects Internet2 Grouper versions prior to 5.6 and Internet2 Grouper for Web Services versions prior to 4.13.1.
What types of authentication are impacted by CVE-2024-39848?
CVE-2024-39848 specifically impacts LDAP authentication mechanisms used in Internet2 Grouper configurations.
Is there a workaround for CVE-2024-39848?
Currently, the recommended solution for CVE-2024-39848 is to apply the necessary software upgrades rather than relying on workarounds.