What’s Vulnerable › Vulnerabilities
CVE-2024-12056: Client Secret not checked with OAuth Password grant type
- Severity: low (CVSS 2.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-04 · updated 2026-06-17
- Weakness: CWE-358
Description
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
Affected products
- arcinfo PcVue: from 12.0 before 16.2.2 — fixed in 16.2.2
How to fix
Upgrade to a fixed version: arcinfo PcVue 16.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-12056 or the next vulnerability affects your stack