How severe is CVE-2024-12056?

This vulnerability has a severity rating of LOW with a CVSS score of N/A out of 10.

What type of vulnerability is CVE-2024-12056?

This is classified as CWE-358, which is a common weakness in software security.

CVE-2024-12056 - LOW Severity | CVSS N/A

Vulnerability Description

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.

Related Vulnerabilities

CVE-2018-0268

CRITICAL

CVSS:10.0(Critical)

A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and gain elevated priv...

CWE-3582018

CVE-2019-6742

CRITICAL

CVSS:10.0(Critical)

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. T...

CWE-3582019

CVE-2016-10229

CRITICAL

CVSS:9.8(Critical)

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with t...

CWE-3582016

CVE-2023-3266

CRITICAL

CVSS:9.8(Critical)

A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated atta...

CWE-3582023

CVE-2024-3845

CRITICAL

CVSS:9.8(Critical)

Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low)

CWE-3582024

CVE-2023-39403

CRITICAL

CVSS:9.1(Critical)

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.

CWE-3582023