CVE-2024-5174 - Vulnerability Details - OpenCVE

A flaw in Gliffy results in broken authentication through the reset functionality of the application.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00154.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2025-4366	A flaw in Gliffy results in broken authentication through the reset functionality of the application.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://portal.perforce.com/s/detail/a91PA000001ScD3YAK

History

Mon, 24 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 24 Feb 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		A flaw in Gliffy results in broken authentication through the reset functionality of the application.
Title		Broken Authentication in Gliffy
Weaknesses		CWE-287
References		https://portal.perforce.com/s/detail/a91PA000001ScD3YAK
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2025-02-24T13:32:19.344Z

Updated: 2025-02-24T14:21:07.331Z

Reserved: 2024-05-21T13:46:50.126Z

Link: CVE-2024-5174

Vulnrichment

Updated: 2025-02-24T14:21:00.320Z

NVD

Status : Received

Published: 2025-02-24T14:15:10.327

Modified: 2025-02-24T14:15:10.327

Link: CVE-2024-5174

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-287

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5174", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2024-05-21T13:46:50.126Z", "datePublished": "2025-02-24T13:32:19.344Z", "dateUpdated": "2025-02-24T14:21:07.331Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Gliffy Online", "vendor": "Gliffy", "versions": [{"lessThan": "4.14.0-7", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "datePublic": "2025-02-24T13:27:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\"> flaw in </span><span style=\"background-color: rgb(255, 255, 255);\">Gliffy</span><span style=\"background-color: rgb(255, 255, 255);\"> results in broken authentication through the reset functionality of the application. </span><br>"}], "value": "A flaw in Gliffy results in broken authentication through the reset functionality of the application."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-02-24T13:32:19.344Z"}, "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001ScD3YAK"}], "source": {"discovery": "UNKNOWN"}, "title": "Broken Authentication in Gliffy", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-24T14:19:22.073610Z", "id": "CVE-2024-5174", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-24T14:21:07.331Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5174", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-24T14:19:22.073610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-24T14:21:00.320Z"}}], "cna": {"title": "Broken Authentication in Gliffy", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gliffy", "product": "Gliffy Online", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.14.0-7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-02-24T13:27:00.000Z", "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001ScD3YAK"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A flaw in Gliffy results in broken authentication through the reset functionality of the application.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A</span><span style=\"background-color: rgb(255, 255, 255);\"> flaw in </span><span style=\"background-color: rgb(255, 255, 255);\">Gliffy</span><span style=\"background-color: rgb(255, 255, 255);\"> results in broken authentication through the reset functionality of the application. </span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-02-24T13:32:19.344Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5174", "state": "PUBLISHED", "dateUpdated": "2025-02-24T14:21:07.331Z", "dateReserved": "2024-05-21T13:46:50.126Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2025-02-24T13:32:19.344Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}