What’s Vulnerable › Vulnerabilities

CVE-2024-4332: Improper Authentication in Tripwire Enterprise 9.1.0 APIs

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-03 · updated 2026-06-17
• Weakness: CWE-303

Description

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.

Affected products

• Fortra Tripwire Enterprise: 9.1.0

References

• https://www.fortra.com/security/advisory/fi-2024-006
• https://www.fortra.com/security/advisory/fi-2024-006

Get alerted when CVE-2024-4332 or the next vulnerability affects your stack