CVE-2024-42164

Disabling MFA without Authentication PUBLISHED

Description (CNA)

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.

Affected (CNA)

Vendor / product	Versions
FIWARE / FIWARE Keyrock	affected 0 through 8.4

CWE

CWE-287

References

https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.