Threat Investigation
Request a demo

CVE-2024-12838

High

Description

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators.

SeverityHigh
CVSS8.8
Exploit probability—
ProductCGFIDO
PublishedDec 31, 2024
First seenDec 31, 2024
Weakness typeCWE-302CWE-302

How to fix

Update
  • Changing Information Technology CGFIDO1.1.0 or later

Affected products

ProductAffected versionsFixed in
Changing Information Technology CGFIDO0.0.1 ≤ v < 1.1.01.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.