OpenCTI's lack of Rate Limit lead to OTP brute forcing
Published Dec 11, 2024
8.1
HIGHCVSS 3.1
EPSS 0.59%
Description
OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available.
Affected products
-
Affected
- < 6.2.8
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| OpenCTI-Platform | Opencti | unknown | Affected
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41714 Advisory
- https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-hg56-r6hh-56j7 exploitx_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41714 | Advisory | |
| https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-hg56-r6hh-56j7 | exploitx_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data