{"id":"CVE-2024-5322","published":"2024-07-01T20:46:40Z","modified":"2024-08-01T21:11:12Z","title":"N-central Authentication Bypass via Session Rebinding","vendor":"N-able","product":"N-central","tier":"tail","description":{"text":"The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.\n \nThis vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0041,"percentile":0.35099,"provenance":"source"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.3%20Release%20Notes.htm","tags":[]},{"url":"https://me.n-able.com/s/security-advisory/aArVy0000000BgDKAU/cve20245322-ncentral-authentication-bypass-via-session-rebinding","tags":[]}],"priority":{"score":13.4,"factors":[{"name":"EPSS percentile","points":7.02},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"n-able","affectedVersions":[{"vendor":"N-able","product":"N-central","versions":["<2024.3"]}],"euvd":{"id":"EUVD-2024-46549","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-n-able-central-cwe-288"}}