CVE-2024-45589

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
identityautomation	rapididentity_lts	<= 2023.0.2
identityautomation	rapididentity_cloud	<= 2024.08.0

References

https://benrogozinski.github.io/CVE-2024-45589/Exploit, Third Party Advisory
https://help.rapididentity.com/docs/rapididentity-lts-release-notesRelease Notes

Timeline

Published: Sep 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-45596.5Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption v CVE-2024-455907.5body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malic CVE-2024-455915.3XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The e CVE-2024-455926.1auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6,CVE-2024-455938.8Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft CVE-2024-455945.4Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS CVE-2024-455959.8D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attacke CVE-2024-455966.5Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last auth CVE-2024-455975.3Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header va CVE-2024-455984.9Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error CVE-2024-455993.8Cursor is an artificial intelligence code editor. Prior to version 0.41.0, if a user on macOS has granted Cursor access to the camera or mic CVE-2024-45609.8The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the