Threat Investigation
Request a demo

CVE-2024-39848

Critical

Description

Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the M3vwHr account. This also affects "Grouper for Web Services" before 4.13.1.

SeverityCritical
CVSS9.1
Exploit probability—
ProductInternet2 Grouper
PublishedJun 29, 2024
First seenJun 29, 2024
Weakness typeCWE-1390CWE-1390

How to fix

Update
  • internet2 grouper5.6 or later

Affected products

ProductAffected versionsFixed in
internet2 grouperv < 5.65.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.