Read the docs

FIWARE

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

FIWARE records in CISA KEV

No FIWARE vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Keyrock 5 records MEDIUM

Records

5 records

TI-2024-28170 CVE-2024-42167 · GHSA-fvfg-7v3r-g9v3

Command Injection in Organisationname

Priority MEDIUM 42

The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00486 Published 2024-08-12 No fix listed CWE-78
TI-2024-28169 CVE-2024-42166 · GHSA-3949-74rr-85j5

Command Injection in Applicationname

Priority MEDIUM 42

The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00486 Published 2024-08-12 No fix listed CWE-78
TI-2024-28166 CVE-2024-42163 · GHSA-qr94-6q3v-pgvj

Password Manipulation

Priority LOW 36

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00328 Published 2024-08-12 No fix listed CWE-326
TI-2024-28168 CVE-2024-42165 · GHSA-8h3p-v5fg-998p

Arbitrary User Activation

Priority LOW 28

Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00359 Published 2024-08-12 No fix listed CWE-330
TI-2024-28167 CVE-2024-42164 · GHSA-572h-92hg-4mqm

Disabling MFA without Authentication

Priority LOW 20

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00356 Published 2024-08-12 No fix listed CWE-287
Open these records in search →