CVE-2023-49706 Race condition in n/a
Remote attackers can exploit a race condition in LinOTP's self-service portal to escalate privileges and act as other users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49706?
CVE-2023-49706 is a medium-severity vulnerability in n/a, published on 19 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with concurrent user activity in the self-service portal.
Weakness: CWE-362
Which versions are affected by CVE-2023-49706?
It affects 2 products.
Products include Linotp Linotp, Linotp Virtual Appliance.
How do I fix CVE-2023-49706?
No fix has been published for CVE-2023-49706 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-49706 being exploited?
There is no known exploitation of CVE-2023-49706 in the wild and no public exploit code.
Sources
Also known as GHSA-pj88-jgpj-pmr9.