oauthenticator 0.6.2/0.7.2/0.7.3/0.12.0 GoogleOAuthenticator.hosted_domain improper authorization

Summaryinfo

A vulnerability has been found in oauthenticator and classified as critical. This impacts the function GoogleOAuthenticator.hosted_domain. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2024-29033. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in oauthenticator. This issue affects the function GoogleOAuthenticator.hosted_domain. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-29033 since 03/14/2024. The exploitation is known to be easy. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 16.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• oauthenticator

Version

• 0.6.2
• 0.7.2
• 0.7.3
• 0.12.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion