« Volver al listado

CVE-2024-45523

Estado: AplazadaCrítica (9.1)—

An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 12.6.2.37183, and 12.7.x before 12.7.1.38241. An unauthenticated attacker can cause a resource leak by issuing multiple failed login attempts through API SOAP.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bravura — Security FabricAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45523",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45523",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-20T13:40:06.394957Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hitachi:id_bravura_security_fabric:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hitachi",
          "product": "id_bravura_security_fabric",
          "versions": [
            {
              "status": "affected",
              "version": "12.3.0",
              "lessThan": "12.3.5.32784",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "12.4.0",
              "lessThan": "12.4.3.35110",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "12.5.0",
              "lessThan": "12.5.2.35950",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "12.6.0",
              "lessThan": "12.6.2.37183",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "12.7.0",
              "lessThan": "12.7.1.38241",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-18T18:15:06.420",
  "references": [
    {
      "url": "https://www.bravurasecurity.com/cve-2024-45523-resource-leak-in-api-after-a-failed-login-attempt",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 12.6.2.37183, and 12.7.x before 12.7.1.38241. An unauthenticated attacker can cause a resource leak by issuing multiple failed login attempts through API SOAP."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en las versiones 12.3.x anteriores a la 12.3.5.32784, 12.4.x anteriores a la 12.4.3.35110, 12.5.x anteriores a la 12.5.2.35950, 12.6.x anteriores a la 12.6.2.37183 y 12.7.x anteriores a la 12.7.1.38241 de Bravura Security Fabric. Un atacante no autenticado puede provocar una fuga de recursos al realizar varios intentos de inicio de sesión fallidos a través de API SOAP."
    }
  ],
  "lastModified": "2026-06-17T07:54:22.800",
  "sourceIdentifier": "cve@mitre.org"
}