Vulnerability · Published Dec 11, 2024 · Assigned by GitHub_M
CVE-2024-45404OpenCTI's lack of Rate Limit lead to OTP brute forcing
High 8.1
In plain English
A high-severity improper authentication in opencti from OpenCTI-Platform. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pycti | 6.2.18 | PYSEC-2024-297 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenCTI-Platform | opencti | < 6.2.8 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N