CVE-2024-45790

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - vdisclose@cert-in.org.in

Published

2024-09-11

Last modified

2024-09-11

Weaknesses

CWE-307

Affected products

• Aim-star (Reedos)
• Mutual Fund Distribution Product Aim-star (Reedos Software Solutions)

References

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291