CVE-2024-45042

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45042", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-21T17:53:51.330Z", "datePublished": "2024-09-26T17:04:59.235Z", "dateUpdated": "2025-03-12T21:17:22.281Z"}, "containers": {"cna": {"title": "Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5"}], "affected": [{"vendor": "ory", "product": "kratos", "versions": [{"version": "< 1.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-26T17:04:59.235Z"}, "descriptions": [{"lang": "en", "value": "Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_available` setting will incorrectly assume that the identity\u2019s highest available AAL is `aal1` even though it really is `aal2`. This means that the `highest_available` configuration will act as if the user has only one factor set up, for that particular user. This means that they can call the settings and whoami endpoint without a `aal2` session, even though that should be disallowed. An attacker would need to steal or guess a valid login OTP of a user who has only OTP for login enabled and who has an incorrect `available_aal` value stored, to exploit this vulnerability. All other aspects of the session (e.g. the session\u2019s aal) are not impacted by this issue. On the Ory Network, only 0.00066% of registered users were affected by this issue, and most of those users appeared to be test users. Their respective AAL values have since been updated and they are no longer vulnerable to this attack. Version 1.3.0 is not affected by this issue. As a workaround, those who require MFA should disable the passwordless code login method. If that is not possible, check the sessions `aal` to identify if the user has `aal1` or `aal2`."}], "source": {"advisory": "GHSA-wc43-73w7-x2f5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-10T17:12:37.404869Z", "id": "CVE-2024-45042", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T21:17:22.281Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-10T17:12:37.404869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T21:17:18.632Z"}}], "cna": {"title": "Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials", "source": {"advisory": "GHSA-wc43-73w7-x2f5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ory", "product": "kratos", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "references": [{"url": "https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5", "name": "https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_available` setting will incorrectly assume that the identity\u2019s highest available AAL is `aal1` even though it really is `aal2`. This means that the `highest_available` configuration will act as if the user has only one factor set up, for that particular user. This means that they can call the settings and whoami endpoint without a `aal2` session, even though that should be disallowed. An attacker would need to steal or guess a valid login OTP of a user who has only OTP for login enabled and who has an incorrect `available_aal` value stored, to exploit this vulnerability. All other aspects of the session (e.g. the session\u2019s aal) are not impacted by this issue. On the Ory Network, only 0.00066% of registered users were affected by this issue, and most of those users appeared to be test users. Their respective AAL values have since been updated and they are no longer vulnerable to this attack. Version 1.3.0 is not affected by this issue. As a workaround, those who require MFA should disable the passwordless code login method. If that is not possible, check the sessions `aal` to identify if the user has `aal1` or `aal2`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-26T17:04:59.235Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45042", "state": "PUBLISHED", "dateUpdated": "2025-03-12T21:17:22.281Z", "dateReserved": "2024-08-21T17:53:51.330Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-09-26T17:04:59.235Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "kratos", "vendor": "ory", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_available` setting will incorrectly assume that the identity\u2019s highest available AAL is `aal1` even though it really is `aal2`. This means that the `highest_available` configuration will act as if the user has only one factor set up, for that particular user. This means that they can call the settings and whoami endpoint without a `aal2` session, even though that should be disallowed. An attacker would need to steal or guess a valid login OTP of a user who has only OTP for login enabled and who has an incorrect `available_aal` value stored, to exploit this vulnerability. All other aspects of the session (e.g. the session\u2019s aal) are not impacted by this issue. On the Ory Network, only 0.00066% of registered users were affected by this issue, and most of those users appeared to be test users. Their respective AAL values have since been updated and they are no longer vulnerable to this attack. Version 1.3.0 is not affected by this issue. As a workaround, those who require MFA should disable the passwordless code login method. If that is not possible, check the sessions `aal` to identify if the user has `aal1` or `aal2`."}, {"lang": "es", "value": "Ory Kratos es un sistema de autenticaci\u00f3n, gesti\u00f3n de usuarios e identidad para servicios en la nube. Antes de la versi\u00f3n 1.3.0, dadas una serie de condiciones previas, la configuraci\u00f3n `highest_available` supon\u00eda incorrectamente que el AAL m\u00e1s alto disponible de la identidad era `aal1`, aunque en realidad era `aal2`. Esto significa que la configuraci\u00f3n `highest_available` actuar\u00eda como si el usuario tuviera solo un factor configurado para ese usuario en particular. Esto significa que pueden llamar a la configuraci\u00f3n y al endpoint whoami sin una sesi\u00f3n `aal2`, aunque eso deber\u00eda estar prohibido. Un atacante necesitar\u00eda robar o adivinar un OTP de inicio de sesi\u00f3n v\u00e1lido de un usuario que solo tiene habilitado el OTP para el inicio de sesi\u00f3n y que tiene un valor `available_aal` incorrecto almacenado, para explotar esta vulnerabilidad. Todos los dem\u00e1s aspectos de la sesi\u00f3n (por ejemplo, el aal de la sesi\u00f3n) no se ven afectados por este problema. En la red Ory, solo el 0,00066 % de los usuarios registrados se vieron afectados por este problema, y la mayor\u00eda de esos usuarios parec\u00edan ser usuarios de prueba. Desde entonces, se han actualizado sus respectivos valores AAL y ya no son vulnerables a este ataque. La versi\u00f3n 1.3.0 no se ve afectada por este problema. Como workaround, quienes requieran MFA deben deshabilitar el m\u00e9todo de inicio de sesi\u00f3n con c\u00f3digo sin contrase\u00f1a. Si eso no es posible, verifique las sesiones `aal` para identificar si el usuario tiene `aal1` o `aal2`."}], "id": "CVE-2024-45042", "lastModified": "2026-06-17T07:53:28.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45042", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-10T17:12:37.404869Z", "version": "2.0.3"}}]}, "published": "2024-09-26T18:15:07.463", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}