CVE-2024-47768: Lif Authentication Server Has No Auth Check When Updating Password In Account Recovery
First published: Fri Oct 04 2024(Updated: )
Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacker knew the email of the target, they could supply the email and immediately prompt the server to update the password without ever needing the code. This issue has been patched in version 1.7.3.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lifplatforms Lif Auth Server | <1.7.3 |
Remedy
https://github.com/Lif-Platforms/Lif-Auth-Server/commit/8dbd7cad914a8b939451c652bfb716aa796f754e
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-47768?
CVE-2024-47768 is classified as a moderate severity vulnerability affecting the Lif Authentication Server.
How do I fix CVE-2024-47768?
To fix CVE-2024-47768, ensure proper validation checks are implemented for the account recovery process.
Which versions of Lif Authentication Server are affected by CVE-2024-47768?
CVE-2024-47768 affects all versions of Lif Authentication Server prior to 1.7.3.
What impact does CVE-2024-47768 have on users?
CVE-2024-47768 may allow unauthorized account access due to insufficient verification of recovery email and code.
Is there a patch available for CVE-2024-47768?
Yes, a patch for CVE-2024-47768 is included in Lif Authentication Server version 1.7.3.
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lifplatforms
- canonical/lifplatforms lif auth server