CVE-2024-5716

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5716
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password reset mechanism. The issue results from the lack of restriction of excessive authentication attempts. An attacker can leverage this vulnerability to reset a user's password and bypass authentication on the system. Was ZDI-CAN-24164.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes Patch
https://www.zerodayinitiative.com/advisories/ZDI-24-616/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:logsign:unified_secops_platform:*:*:*:*:*:*:*:*
History

10 Jul 2025, 16:09

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.6 		v2 : unknown
v3 : 9.8
Summary
  • (es) Vulnerabilidad de omisión de autenticación de Logsign Unified SecOps Platform. Esta vulnerabilidad permite a atacantes remotos omitir la autenticación en las instalaciones afectadas de Logsign Unified SecOps Platform. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica existe dentro del mecanismo de restablecimiento de contraseña. El problema es el resultado de la falta de restricción de intentos de autenticación excesivos. Un atacante puede aprovechar esta vulnerabilidad para restablecer la contraseña de un usuario y omitir la autenticación en el sistema. Era ZDI-CAN-24164.
First Time Logsign
Logsign unified Secops Platform
References () https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes - () https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes - Patch
References () https://www.zerodayinitiative.com/advisories/ZDI-24-616/ - () https://www.zerodayinitiative.com/advisories/ZDI-24-616/ - Third Party Advisory
CPE cpe:2.3:a:logsign:unified_secops_platform:*:*:*:*:*:*:*:*

22 Nov 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-22 20:15

Updated : 2025-07-10 16:09

NVD link : CVE-2024-5716

Mitre link : CVE-2024-5716

CVE.ORG link : CVE-2024-5716

JSON object : View

Products Affected

logsign

  • unified_secops_platform
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts