CVE-2024-12056

EUVD-2024-50561
The Client secret is not checked when using the OAuth Password grant type.

By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment.
Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
arcinfoCNA
2.3 LOW
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:N/R:U/RE:M/U:Green
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
arcinfopcvue
12.0 ≤
𝑥
< 16.2.2
CNA
Common Weakness Enumeration
References
https://www.pcvue.com/security/security/#SB2024-4