CVE-2024-45404

Description

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available.

Weakness classification

• CWE-287: Improper Authentication
• CWE-307: Improper Restriction of Excessive Authentication Attempts

Primary references

• security-advisories@github.com — Vendor Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Vendor Advisory