CVE-2024-38371 : GOAUTHENTIK PRIOR 2024.2.4/2024.4.3/2024.6.0 ACCESS CONTROL

Description

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.

References

https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45

https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4

https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3

https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0

For More Information

CVERecord

Contact us to get started

CVE-2024-5711 : STITIONAI DEVIKA CROSS SITE SCRIPTING

Description Cross-site Scripting (XSS) – Stored in GitHub repository stitionai/devika prior to -. References https://huntr.com/bounties/6c00ff84-574b-4b4f-bd58-aa7ec1809662 https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 For More Information CVERecord

Learn more