CVE-2024-5716

The flaw results from the lack of restrictions on the number of authentication attempts in the password reset mechanism (CWE-307 — insufficient protection against excessive number of attempts). An attacker can repeatedly send password reset requests without any blocks or limits. This makes it possible to effectively reset any user's password and then log in to their account. No prior authentication or user interaction is required to exploit the vulnerability.

An attacker can take control of any user account on the platform, gaining full access (confidentiality, integrity, and availability of the system) to the Logsign Unified SecOps Platform environment. In the case of administrative accounts, this results in complete system compromise.

Update Logsign Unified SecOps Platform to version 6.4.8 or later in accordance with the information in the vendor's official Release Notes available at the address indicated in the references. Until the patch is applied, it is recommended to restrict network access to the platform interface only to trusted hosts.

Logsign Unified SecOps Platform — versions indicated in vendor references (patch available from version 6.4.8 in accordance with vendor Release Notes from 03.06.2024)