Vulnerability · Published Jun 11, 2024 · Assigned by BT
CVE-2024-5812Smart Rule Overwrite Bypass in BeyondInsight PasswordSafe
Low 3.3
In plain English
A low-severity authentication bypass by spoofing in BeyondInsight PasswordSafe from BeyondTrust. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BeyondTrust | BeyondInsight PasswordSafe | 24.1.0 – before 24.1.123.3.0 – before 23.3.0.95923.2.0 – before 23.2.0.1293 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N