CVE-2024-46937

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
mfasoft	secure_authentication_server	>= 1.8.x, < 1.9.040924

References

https://github.com/WI1D-41/IDOR-in-MFASOFT-Secure-Authentication-ServerThird Party Advisory
https://mfasoft.ruProduct

Timeline

Published: Sep 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-469387.5An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thro CVE-2024-469392.4The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path tr CVE-2024-469414.8SystemUI has an incorrect component protection setting, which allows access to specific information.CVE-2024-469426.5In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries CVE-2024-469437.5An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a clu CVE-2024-469469.8langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sy CVE-2024-469476.5Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.CVE-2024-469484.3Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.CVE-2024-46955.4The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, CVE-2024-469517.8An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space co CVE-2024-469527.8An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef st CVE-2024-469537.8An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format strin