Threat Investigation
Request a demo

CVE-2024-51557

Medium

Description

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

SeverityMedium
CVSS6.5
Exploit probability—
Product63moons Wave
PublishedNov 4, 2024
First seenNov 4, 2024
Weakness typeCWE-799CWE-799

How to fix

Update
  • 63moons wave_2.01.1.7 or later
  • 63moons aero120820241550 or later

Affected products

ProductAffected versionsFixed in
63moons wave_2.0v < 1.1.71.1.7
63moons aerov < 120820241550120820241550

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.