CVE-2024-50618

A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-11 20:16

Updated : 2026-06-17 08:04

NVD link : CVE-2024-50618

Mitre link : CVE-2024-50618

CVE.ORG link : CVE-2024-50618

JSON object : View

Products Affected

cipplanner

cipace

CWE

CWE-308

Use of Single-factor Authentication

{"id": "CVE-2024-50618", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50618", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T21:04:53.651539Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-11T20:16:07.017", "references": [{"url": "https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-308"}]}], "descriptions": [{"lang": "en", "value": "A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised."}, {"lang": "es", "value": "Una vulnerabilidad de uso de autenticaci\u00f3n de un solo factor en el componente de autenticaci\u00f3n de CIPPlanner CIPAce anterior a 9.17 permite a los atacantes eludir un mecanismo de protecci\u00f3n. Cuando el sistema est\u00e1 configurado para permitir el inicio de sesi\u00f3n con cuentas internas, un atacante puede posiblemente obtener autenticaci\u00f3n completa si el secreto en un esquema de autenticaci\u00f3n de un solo factor se ve comprometido."}], "lastModified": "2026-06-17T08:04:49.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5F8D48-AC37-455A-A9AC-7950E70027D7", "versionEndExcluding": "9.17"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}