CVE-2024-54002

Summary

CVE-2024-54002 affects Dependency-Track, a component analysis platform used by organizations to manage their software supply chain. A login request against the /api/v1/user/login endpoint takes significantly longer when using a known username compared to an unknown one, potentially allowing attackers to enumerate valid usernames. This issue, which does not affect LDAP and OpenID Connect users, has been resolved in Dependency-Track version 4.12.2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.