Read the docs
TI-2024-36157 Aliases CVE-2024-54002

Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

Priority LOW 30CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username that is not known by the system. The observable difference in request duration can be leveraged by actors to enumerate valid names of managed users. LDAP and OpenID Connect users are not affected. The issue has been fixed in Dependency-Track 4.12.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed dependency-track (DependencyTrack): 4.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DependencyTrackdependency-trackbefore 4.12.24.12.2Patch availableCNA
  • dependency-track VendorDependencyTrack Affected before 4.12.2 Fixed in 4.12.2 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:dependencytrack:dependency-track:*:*:*:*:*:*:*:*——DependencyTrack
  • cpe:2.3:a:dependencytrack:dependency-track:*:*:*:*:*:*:*:* Versions — — ·DependencyTrack

Remediation

  • Fix · CNA dependency-track (DependencyTrack) Fixed in 4.12.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-54002

References

Other 1

  • TI-2025-19994 Dependency-Track vulnerable to local file inclusion via custom notification templates CVSS 3.1MEDIUM 4.4
  • TI-2025-40096 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message CVSS 3.1MEDIUM 4.8
  • TI-2025-38169 Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences