{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-24771 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-24771 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-24771 is a high-severity authentication bypass vulnerability in open-formulieren open-forms, published on 7 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-24771 and fix it if it is affected.\n\nWhat it is: CVE-2024-24771 is a high-severity authentication bypass vulnerability in open-formulieren open-forms, published on 7 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-24771 in the wild and no public exploit code.\n\nAffected product: open-formulieren open-forms. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-24771/ (Markdown: https://insights.sbomify.com/CVE-2024-24771/index.md)","id":"CVE-2024-24771","markdown":"https://insights.sbomify.com/CVE-2024-24771/index.md","name":"CVE-2024-24771","record":{"aliases":["GHSA-64r3-x3gf-vp63"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Open Forms","requires_auth":"high_privilege","summary":"Compromised superuser credentials could bypass MFA to view or modify sensitive submission data if specific API endpoints were accessible.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"open_forms","vendor":"maykinmedia"}],"cvss":{"score":7.7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-654","name":"Reliance on a Single Factor in a Security Decision"},{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-284","name":"Improper Access Control"}],"description":"Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim's account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Open Forms potential multi-factor authentication bypass","id":"CVE-2024-24771","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2024"},"n_packages":0,"n_references":5,"next":{"headline":"Apache Superset: Improper Neutralisation of custom SQL on embedded context","id":"CVE-2024-24772"},"packages":[],"prev":{"headline":"Username timing attack on recover password/MFA token in vantage6","id":"CVE-2024-24770"},"products":["open-forms"],"published":"2024-02-07","related":[{"cvss_score":7.6,"headline":"Insufficient content-type validation for uploaded files in open-forms","id":"CVE-2022-31041","kev_date_added":null,"published":"2022-06-13"},{"cvss_score":7.1,"headline":"Open Redirect in open-forms","id":"CVE-2022-31040","kev_date_added":null,"published":"2022-06-13"},{"cvss_score":6.5,"headline":"Open Forms possible to view submission details of other people than intended","id":"CVE-2026-28803","kev_date_added":null,"published":"2026-03-11"},{"cvss_score":4.3,"headline":"Open Forms prefill data in read-only components can be tampered","id":"CVE-2025-64515","kev_date_added":null,"published":"2025-11-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-01-30","vendors":["open-formulieren"]},"summary":"Compromised superuser credentials could bypass MFA to view or modify sensitive submission data if specific API endpoints were accessible.","url":"https://insights.sbomify.com/CVE-2024-24771/"}