Tripwire, a leading provider of integrity monitoring and security solutions, disclosed a critical vulnerability in its Tripwire Enterprise (TE) software.
The flaw, identified as CVE-2024-4332, allows unauthenticated attackers to bypass authentication and gain privileged access to Tripwire Enterprise 9.1.0’s REST and SOAP APIs when the software is configured to use LDAP/Active Directory SAML authentication with the optional “Auto-synchronize LDAP Users, Roles, and Groups” feature enabled.
According to the Fortra blog, the vulnerability, classified as CWE-303: Incorrect Implementation of Authentication Algorithm, was discovered on April 25, 2024. It has been assigned a CVSS v3.1 score of 9.8, indicating a critical severity level.
Successful exploitation of this flaw could allow remote attackers to gain unauthorized access to sensitive information or modify data through the compromised APIs.
With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis
According to Tripwire, the vulnerability only affects Tripwire Enterprise version 9.1.0. This flaw does not impact users of Tripwire ExpertOps and earlier versions of Tripwire Enterprise.
To address this critical vulnerability, Tripwire has released Tripwire Enterprise 9.1.1, which includes a fix for the authentication bypass issue.
The company strongly recommends that affected users upgrade to the latest version to ensure the security of their systems.
For users who are unable to upgrade immediately and are using the LDAP/Active Directory system login method with “Auto Synchronize LDAP Users, Roles, and Groups” enabled, Tripwire suggests disabling this feature in the Settings manager under the “Login Method” section as a temporary mitigation measure.
However, it is important to note that disabling this feature will also disable API access.
To continue using the Tripwire Enterprise APIs securely, users must upgrade to version 9.1.1 or select a different login method.
Importance of Timely Patching
This vulnerability highlights the importance of keeping software up to date and applying security patches promptly.
Cybercriminals often exploit known vulnerabilities to gain unauthorized access to systems and data.
By prioritizing regular software updates and maintaining a robust patch management process, organizations can significantly reduce their exposure to potential cyber threats.
Tripwire Enterprise users are advised to review their software configurations and take immediate action to mitigate the risk associated with this critical vulnerability.
Users should contact Tripwire support or refer to the official security advisory for further information and assistance.
Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo