CVE-2024-24966

published 2024-02-14

CVE-2024-24966: When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which…

Priority P4 28 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C H I N A N

When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
f5	f5os	—	—
f5	f5os-a	—	—
f5	f5os-a	—	—
f5	f5os-c	—	—
f5	f5os-c	>= 1.3.0 < 1.6.0	1.6.0
f5	f5os_appliance	>= 1.2.0 < 1.3.0	1.3.0
f5	f5os_chassis	>= 1.3.0 < 1.6.0	1.6.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863