GroupMe allows a unauthenticated attacker to elevate privileges over a network.</p> CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"/>GroupMe allows a unauthenticated attacker to elevate privileges over a network.</p> CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"/>

CVE-2024-38176

Improper Restriction of Excessive Authentication Attempts (CWE-307)

Published: Jul 23, 2024

010
CVSS 8.1EPSS 0.09%High
CVE info copied to clipboard

Summary

An improper restriction of excessive authentication attempts in GroupMe allows an unauthenticated attacker to elevate privileges over a network. This vulnerability is associated with CWE-307: Improper Restriction of Excessive Authentication Attempts.

Impact

This vulnerability has a high severity with a CVSS v3.1 base score of 8.1. It could allow an unauthenticated attacker to gain elevated privileges within the GroupMe application over a network. The impact is severe, with high potential for compromising confidentiality, integrity, and availability of the system. Attackers could potentially access sensitive information, modify data, or disrupt service operations. The vulnerability affects all three key aspects of security: confidentiality, integrity, and availability, all rated as HIGH impact.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft has released an official fix for this vulnerability as of July 23, 2024. Security teams should prioritize applying this patch as soon as possible.

Mitigation

1. Apply the official patch released by Microsoft as soon as possible. 2. Implement strong authentication mechanisms and multi-factor authentication. 3. Monitor and limit authentication attempts, implementing account lockout policies. 4. Use network segmentation to limit the potential spread if a breach occurs. 5. Regularly monitor system logs for any suspicious authentication activities. 6. Keep all systems and software up-to-date with the latest security patches.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVSS

A CVSS base score of 8.1 has been assigned.

Jul 23, 2024 at 9:30 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-38176. See article

Jul 23, 2024 at 9:31 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jul 23, 2024 at 9:33 PM
CVE Assignment

NVD published the first details for CVE-2024-38176

Jul 23, 2024 at 10:15 PM
Trending

This CVE started to trend in security discussions

Jul 24, 2024 at 2:18 AM
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.4%)

Jul 24, 2024 at 9:39 AM
Trending

This CVE stopped trending in security discussions

Jul 26, 2024 at 1:10 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/groupme
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1110.001: Password Guessing
+null more

Attack Patterns

CAPEC-16: Dictionary-based Password Attack
+null more

References

CVE-2024-38176 - Security Update Guide - Microsoft - GroupMe Elevation of Privilege Vulnerability
There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
GroupMe Elevation of Privilege Vulnerability
Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability? An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network.
CVE-2024-38176 GroupMe Elevation of Privilege Vulnerability
An improper restriction of excessive authentication attempts in [GroupMe](https://groupme.com/) allows a unauthenticated attacker to elevate privileges over a network.

News

Update Tue Aug 20 14:33:25 UTC 2024
Update Tue Aug 20 14:33:25 UTC 2024
Vulnerability Summary for the Week of July 22, 2024
Vulnerability Summary for the Week of July 22, 2024 bjackson Jul 29, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 202ecommerce--paypal In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable. 2024-07-26 7.5 CVE-2024-41670 security-advisories@github.com ABB--Advant MOD 300 AdvaBuild AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specific executables. Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. 2024-07-23 8.8 CVE-2020-11640 cybersecurity@ch.abb.com ABB--Advant MOD 300 AdvaBuild An attacker could exploit the vulnerability by injecting garbage data or specially crafted data.
In Other News: FBI Cyber Action Team, Pentagon IT Firm Leak, Nigerian Gets 12 Years in Prison
The FBI has published a story on its Cyber Action Team, which can be deployed across the world within hours to help critical infrastructure organizations respond to cyberattacks and other threats. Web3 identity solutions provider Fractal ID revealed that a threat actor recently managed to exfiltrate data belonging to 6,300 users — representing less than 1% of its user base — after compromising credentials for an operator account that had admin privileges.
Multiple vulnerabilities in Microsoft GroupMe
The vulnerability exists due to improper access restrictions in GroupMe. A remote attacker can trick a victim to click on a malicious link and gain elevated privileges on the system. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
MS Family July 2024 Routine Security Update Advisory
Improper access control vulnerability in GroupMe that could allow an unauthenticated attacker to elevate privileges on the network by tricking users into clicking a malicious link (CVE-2024-38164) Vulnerability in GroupMe improperly limiting excessive authentication attempts, which could allow an unauthenticated attacker to escalate privileges on the network (CVE-2024-38176)
See 14 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI