CVE-2024-51561 Authentication bypass Vulnerability in Aero
An authenticated attacker can bypass OTP verification to access other user accounts in Aero due to improper validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-51561?
CVE-2024-51561 is a critical authentication bypass vulnerability in Brokerage Technology Solutions Aero, published on 4 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process.
Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for accessing other user accounts.
Weakness: CWE-807
Which versions are affected by CVE-2024-51561?
It affects 2 products.
Products include 63moons Aero, 63moons Wave 2.0.
How do I fix CVE-2024-51561?
No fix has been published for CVE-2024-51561 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-51561 being exploited?
There is no known exploitation of CVE-2024-51561 in the wild and no public exploit code.
Other vulnerabilities in Brokerage Technology Solutions Aero
- CVE-2024-51558 Brute Force Attack Vulnerability in Wave 2.0
- CVE-2024-51556 Sensitive Information Disclosure Vulnerability in Wave 2.0
- CVE-2024-51557 No Rate Limiting Vulnerability in Wave 2.0
- CVE-2024-51559 Improper Access Control Vulnerability in Wave 2.0
- CVE-2024-51560 Improper Error Handling Vulnerability in Wave 2.0
Sources
Also known as GHSA-wjjv-5wqm-9j59.