Search
Find a vulnerability
Search criteria
8 vulnerabilities found for verify by okta
CVE-2024-9191 (GCVE-0-2024-9191)
Vulnerability from nvd – Published: 2024-11-01 21:21 – Updated: 2024-11-05 15:23
VLAI
EPSS
VEX
Summary
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.
Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-05 15:22 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/ | vendor-advisory |
| https://help.okta.com/oie/en-us/content/topics/re… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
5.0.2 , < 5.3.3
(semver)
|
|
| okta | verify |
Affected:
5.0.2 , < 5.3.3
(semver)
cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
Date Public
2024-11-01 20:15
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"lessThan": "5.3.3",
"status": "affected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T15:22:10.829745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T15:23:21.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "5.3.3",
"status": "affected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-11-01T20:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T21:21:11.040Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/"
},
{
"url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is present in Okta Verify versions 5.0.2 to 5.3.2 and resolved in Okta Verify for Windows version 5.3.3. To remediate this vulnerability, upgrade Okta Verify for Windows to version 5.3.3 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-9191",
"datePublished": "2024-11-01T21:21:11.040Z",
"dateReserved": "2024-09-25T20:44:58.116Z",
"dateUpdated": "2024-11-05T15:23:21.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10327 (GCVE-0-2024-10327)
Vulnerability from nvd – Published: 2024-10-24 20:17 – Updated: 2024-10-25 15:22
VLAI
EPSS
VEX
Summary
A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed.
The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include:
* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device;
* When a user is presented with a notification on the home screen and drags the notification down and selects their reply;
* When an Apple Watch is used to reply directly to a notification.
A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-25 15:21 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/okta-v… | vendor-advisory |
| https://help.okta.com/en-us/content/topics/releas… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for iOS |
Affected:
9.25.1
(semver)
Affected: 9.27.0 (semver) |
|
| okta | verify |
Affected:
9.25.1
Affected: 9.27.0 cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
Date Public
2024-10-24 20:15
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"status": "affected",
"version": "9.25.1"
},
{
"status": "affected",
"version": "9.27.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-25T15:21:49.116020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T15:22:54.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for iOS",
"vendor": "Okta",
"versions": [
{
"status": "affected",
"version": "9.25.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.27.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-10-24T20:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user\u2019s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:20:37.434Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/"
},
{
"url": "https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is resolved in Okta Verify for iOS version 9.27.2. To remediate this vulnerability, upgrade Okta Verify for iOS to version 9.27.2 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-10327",
"datePublished": "2024-10-24T20:17:59.360Z",
"dateReserved": "2024-10-23T23:57:14.831Z",
"dateUpdated": "2024-10-25T15:22:54.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7061 (GCVE-0-2024-7061)
Vulnerability from nvd – Published: 2024-08-07 16:35 – Updated: 2024-08-09 13:44
VLAI
EPSS
VEX
Summary
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-09 13:44 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/okta-v… | vendor-advisory |
| https://help.okta.com/oie/en-us/content/topics/re… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
5.0.1 , < 5.0.1
(semver)
Unaffected: 5.0.2 (semver) |
Date Public
2024-08-07 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-09T13:44:41.455152Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-09T13:44:51.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "5.0.1",
"status": "affected",
"version": "5.0.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability."
}
],
"datePublic": "2024-08-07T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:37:01.719Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/"
},
{
"url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-7061",
"datePublished": "2024-08-07T16:35:44.403Z",
"dateReserved": "2024-07-23T21:04:37.452Z",
"dateUpdated": "2024-08-09T13:44:51.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0980 (GCVE-0-2024-0980)
Vulnerability from nvd – Published: 2024-03-27 23:16 – Updated: 2024-08-01 18:26
VLAI
EPSS
VEX
Summary
The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-30 04:00 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
0 , < 4.10.7
(semver)
|
|
| okta | verify |
Affected:
0 , < 4.10.7
(semver)
cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"lessThan": "4.10.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-0980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-30T04:00:54.049277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T20:01:32.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:26:30.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "4.10.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"value": "The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en"
},
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path or Element",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-28T16:59:21.177Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-0980",
"datePublished": "2024-03-27T23:16:37.513Z",
"dateReserved": "2024-01-26T22:42:20.854Z",
"dateUpdated": "2024-08-01T18:26:30.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9191 (GCVE-0-2024-9191)
Vulnerability from cvelistv5 – Published: 2024-11-01 21:21 – Updated: 2024-11-05 15:23
VLAI
EPSS
VEX
Summary
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.
Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-05 15:22 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/ | vendor-advisory |
| https://help.okta.com/oie/en-us/content/topics/re… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
5.0.2 , < 5.3.3
(semver)
|
|
| okta | verify |
Affected:
5.0.2 , < 5.3.3
(semver)
cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
Date Public
2024-11-01 20:15
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"lessThan": "5.3.3",
"status": "affected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T15:22:10.829745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T15:23:21.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "5.3.3",
"status": "affected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-11-01T20:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T21:21:11.040Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/"
},
{
"url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is present in Okta Verify versions 5.0.2 to 5.3.2 and resolved in Okta Verify for Windows version 5.3.3. To remediate this vulnerability, upgrade Okta Verify for Windows to version 5.3.3 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-9191",
"datePublished": "2024-11-01T21:21:11.040Z",
"dateReserved": "2024-09-25T20:44:58.116Z",
"dateUpdated": "2024-11-05T15:23:21.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10327 (GCVE-0-2024-10327)
Vulnerability from cvelistv5 – Published: 2024-10-24 20:17 – Updated: 2024-10-25 15:22
VLAI
EPSS
VEX
Summary
A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed.
The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include:
* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device;
* When a user is presented with a notification on the home screen and drags the notification down and selects their reply;
* When an Apple Watch is used to reply directly to a notification.
A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-25 15:21 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/okta-v… | vendor-advisory |
| https://help.okta.com/en-us/content/topics/releas… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for iOS |
Affected:
9.25.1
(semver)
Affected: 9.27.0 (semver) |
|
| okta | verify |
Affected:
9.25.1
Affected: 9.27.0 cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
Date Public
2024-10-24 20:15
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"status": "affected",
"version": "9.25.1"
},
{
"status": "affected",
"version": "9.27.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-25T15:21:49.116020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T15:22:54.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for iOS",
"vendor": "Okta",
"versions": [
{
"status": "affected",
"version": "9.25.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.27.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-10-24T20:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user\u2019s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:20:37.434Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/"
},
{
"url": "https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is resolved in Okta Verify for iOS version 9.27.2. To remediate this vulnerability, upgrade Okta Verify for iOS to version 9.27.2 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-10327",
"datePublished": "2024-10-24T20:17:59.360Z",
"dateReserved": "2024-10-23T23:57:14.831Z",
"dateUpdated": "2024-10-25T15:22:54.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7061 (GCVE-0-2024-7061)
Vulnerability from cvelistv5 – Published: 2024-08-07 16:35 – Updated: 2024-08-09 13:44
VLAI
EPSS
VEX
Summary
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-09 13:44 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://trust.okta.com/security-advisories/okta-v… | vendor-advisory |
| https://help.okta.com/oie/en-us/content/topics/re… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
5.0.1 , < 5.0.1
(semver)
Unaffected: 5.0.2 (semver) |
Date Public
2024-08-07 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-09T13:44:41.455152Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-09T13:44:51.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "5.0.1",
"status": "affected",
"version": "5.0.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability."
}
],
"datePublic": "2024-08-07T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:37:01.719Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/"
},
{
"url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-7061",
"datePublished": "2024-08-07T16:35:44.403Z",
"dateReserved": "2024-07-23T21:04:37.452Z",
"dateUpdated": "2024-08-09T13:44:51.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0980 (GCVE-0-2024-0980)
Vulnerability from cvelistv5 – Published: 2024-03-27 23:16 – Updated: 2024-08-01 18:26
VLAI
EPSS
VEX
Summary
The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-30 04:00 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Verify for Windows |
Affected:
0 , < 4.10.7
(semver)
|
|
| okta | verify |
Affected:
0 , < 4.10.7
(semver)
cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "verify",
"vendor": "okta",
"versions": [
{
"lessThan": "4.10.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-0980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-30T04:00:54.049277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T20:01:32.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:26:30.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Verify for Windows",
"vendor": "Okta",
"versions": [
{
"lessThan": "4.10.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"value": "The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en"
},
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path or Element",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-28T16:59:21.177Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2024-0980",
"datePublished": "2024-03-27T23:16:37.513Z",
"dateReserved": "2024-01-26T22:42:20.854Z",
"dateUpdated": "2024-08-01T18:26:30.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}