« Volver al listado

CVE-2024-9191

Estado: AnalizadaAlta (7.8)—

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.

Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L, PR:L, UI:N indica escalada de privilegios local. OktaDeviceAccessPipe permite acceder a credenciales de MFA passwordless (T1552.007: credenciales en memoria/procesos). Afecta solo Windows con Device Access activo.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementPrivileged Account ManagementActive Directory ConfigurationUser TrainingThreat Intelligence ProgramPassword Policies

Tecnologías afectadas (1)

Okta — Verify

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9191",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9191",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-05T15:22:10.829745Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@okta.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@okta.com",
      "affectedData": [
        {
          "vendor": "Okta",
          "product": "Okta Verify for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.2",
              "lessThan": "5.3.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
          ],
          "vendor": "okta",
          "product": "verify",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.2",
              "lessThan": "5.3.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-01T22:15:03.213",
  "references": [
    {
      "url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4",
      "tags": [
        "Release Notes"
      ],
      "source": "psirt@okta.com"
    },
    {
      "url": "https://trust.okta.com/security-advisories/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@okta.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@okta.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."
    },
    {
      "lang": "es",
      "value": "Las funciones de Okta Device Access, proporcionadas por el agente Okta Verify para Windows, brindan acceso a OktaDeviceAccessPipe, que permite a los atacantes en un dispositivo comprometido recuperar las contraseñas asociadas con los inicios de sesión sin contraseña de Desktop MFA. La vulnerabilidad se descubrió mediante pruebas de penetración rutinarias. Nota: una condición previa de esta vulnerabilidad es que el usuario debe estar usando la función sin contraseña de Okta Device Access. Los usuarios de Okta Device Access que no usan la función sin contraseña no se ven afectados, y los clientes que solo usan Okta Verify en plataformas distintas de Windows o que solo usan FastPass no se ven afectados."
    }
  ],
  "lastModified": "2026-06-17T08:24:06.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:okta:verify:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F74F5903-4967-4F07-A68B-6BF6B56F089D",
              "versionEndExcluding": "5.3.3",
              "versionStartIncluding": "5.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@okta.com"
}