CVE-2024-7604: Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability
First published: Wed Aug 21 2024(Updated: )
Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of the user's license expiration date. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25029.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Logsign Unified SecOps Platform | ||
| Logsign Unified SecOps Platform | =6.4.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7604?
CVE-2024-7604 is classified as a high severity vulnerability due to its ability to allow local attackers to bypass authentication.
How do I fix CVE-2024-7604?
To fix CVE-2024-7604, users should update to the latest version of Logsign Unified SecOps Platform that addresses this vulnerability.
Who is affected by CVE-2024-7604?
CVE-2024-7604 affects installations of Logsign Unified SecOps Platform version 6.4.20.
What is the nature of CVE-2024-7604?
CVE-2024-7604 is an incorrect authorization vulnerability that enables local attackers to bypass authentication.
Can CVE-2024-7604 be exploited remotely?
CVE-2024-7604 requires local access to the system to exploit, meaning it cannot be exploited remotely.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1104
- alias/ZDI-CAN-25029
- alias/CVE-2024-7604
- agent/software-canonical-lookup
- agent/description
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/trending
- agent/tags
- agent/source
- vendor/logsign
- canonical/logsign unified secops platform
- version/logsign unified secops platform/6.4.20