CVE-2024-51720 - Vulnerability Details - OpenCVE

An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://support.blackberry.com/pkb/s/article/140220

History

Tue, 12 Nov 2024 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 Nov 2024 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-307

Tue, 12 Nov 2024 18:15:00 +0000

Type	Values Removed	Values Added
Description		An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.
Title		Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
References		https://support.blackberry.com/pkb/s/article/140220
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: blackberry

Published: 2024-11-12T18:01:49.411Z

Updated: 2024-11-12T21:38:39.845Z

Reserved: 2024-10-30T17:19:06.485Z

Link: CVE-2024-51720

Vulnrichment

Updated: 2024-11-12T21:38:36.144Z

NVD

Status : Awaiting Analysis

Published: 2024-11-12T18:15:46.693

Modified: 2024-11-13T17:01:58.603

Link: CVE-2024-51720

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51720", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "state": "PUBLISHED", "assignerShortName": "blackberry", "dateReserved": "2024-10-30T17:19:06.485Z", "datePublished": "2024-11-12T18:01:49.411Z", "dateUpdated": "2024-11-12T21:38:39.845Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["SecuSUITE Secure Client Authentication"], "product": "SecuSUITE", "vendor": "BlackBerry", "versions": [{"status": "affected", "version": "5.0.420"}]}], "datePublic": "2024-11-12T17:35:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\">n insufficient entropy vul</span><span style=\"background-color: rgb(255, 255, 255);\">nerability </span><span style=\"background-color: rgb(255, 255, 255);\">in the </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span> <span style=\"background-color: rgb(255, 255, 255);\">Secure Client Authentication (SCA) Server </span><span style=\"background-color: rgb(255, 255, 255);\">of </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\"> 5.</span><span style=\"background-color: rgb(255, 255, 255);\">0.420 and earlie</span><span style=\"background-color: rgb(255, 255, 255);\">r could allow an </span><span style=\"background-color: rgb(255, 255, 255);\">attacker to potentially </span><span style=\"background-color: rgb(255, 255, 255);\">enroll an attacker-controlled device to the victim\u2019s account and telephone number.</span> "}], "value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number."}], "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2024-11-12T18:42:07.932Z"}, "references": [{"url": "https://support.blackberry.com/pkb/s/article/140220"}], "source": {"discovery": "UNKNOWN"}, "title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-12T21:38:30.257463Z", "id": "CVE-2024-51720", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T21:38:39.845Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-51720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-12T21:38:30.257463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T21:38:36.144Z"}}], "cna": {"title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BlackBerry", "modules": ["SecuSUITE Secure Client Authentication"], "product": "SecuSUITE", "versions": [{"status": "affected", "version": "5.0.420"}], "defaultStatus": "unaffected"}], "datePublic": "2024-11-12T17:35:00.000Z", "references": [{"url": "https://support.blackberry.com/pkb/s/article/140220"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\">n insufficient entropy vul</span><span style=\"background-color: rgb(255, 255, 255);\">nerability </span><span style=\"background-color: rgb(255, 255, 255);\">in the </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span> <span style=\"background-color: rgb(255, 255, 255);\">Secure Client Authentication (SCA) Server </span><span style=\"background-color: rgb(255, 255, 255);\">of </span><span style=\"background-color: rgb(255, 255, 255);\">SecuSUITE</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\"> 5.</span><span style=\"background-color: rgb(255, 255, 255);\">0.420 and earlie</span><span style=\"background-color: rgb(255, 255, 255);\">r could allow an </span><span style=\"background-color: rgb(255, 255, 255);\">attacker to potentially </span><span style=\"background-color: rgb(255, 255, 255);\">enroll an attacker-controlled device to the victim\u2019s account and telephone number.</span> ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2024-11-12T18:42:07.932Z"}}}, "cveMetadata": {"cveId": "CVE-2024-51720", "state": "PUBLISHED", "dateUpdated": "2024-11-12T21:38:39.845Z", "dateReserved": "2024-10-30T17:19:06.485Z", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "datePublished": "2024-11-12T18:01:49.411Z", "assignerShortName": "blackberry"}, "dataVersion": "5.1"}