CVE-2024-52586

CVSS V2 None CVSS V3 None

Description

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally (by knowing or guessing the password of a user) can thus log in regardless of MFA requirements. This does not affect MFA that are performed by single sign-on services. Users are advised to upgrade to at least version 5.1.9 to receive a fix.

Overview

CVE ID
CVE-2024-52586

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-12-09T18:38:42.856Z

Last Modified Date
2024-12-09T18:38:42.856Z

Weakness Enumerations

CWE	URL
CWE-288	http://cwe.mitre.org/data/definitions/288.html
CWE-303	http://cwe.mitre.org/data/definitions/303.html

References

Reference URL	Reference Tags
https://github.com/elabftw/elabftw/security/advisories/GHSA-pvxr-39g3-m28c	x_refsource_CONFIRM

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-52586
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52586

History

Created	Old Value	New Value	Data Type	Notes
2024-12-10 13:53:24				Added to TrackCVE