CVE-2024-8260: openpolicyagent open_policy_agent Authentication Bypass by Capture-replay
CVSS: 7.3v3.1HighAnalyzed
AliasesCGA-2xpp-rwm8-785rCGA-345q-cwvw-73r3CGA-73w6-jwcv-37xvCGA-7mr2-xc2h-7xjgCGA-89hf-x5r9-3q88CGA-8v9j-p3wq-rgw8CGA-9rv9-qxm5-mhj2CGA-c2f2-3vhf-5jrpCGA-c772-8gp8-r34vCGA-ccx3-p9p5-px39CGA-ff4f-qp4j-5674CGA-fgx8-mp9f-397wCGA-gch5-x8j8-xv89CGA-gg7m-2q46-qfxhCGA-gj5v-fcv4-8q2rCGA-gqcp-wq9w-g9f2CGA-j9xh-rwpg-gvrfCGA-jfcf-26mx-969vCGA-jp4m-7jpr-h5h6CGA-jqq2-67gm-8f28CGA-pp9r-rf3m-qh9jCGA-r4pg-mrcx-995wCGA-r55g-mgq5-rg66CGA-v29m-37jp-wwfvCGA-w546-qqmp-vp4xCGA-w797-h76r-x4vxCGA-wccw-m4j8-c4rjCGA-whj3-v8cg-wwhmCGA-wphm-65pm-wf5rCGA-wwj2-q549-x3wmCGA-wwvv-fcv4-739rCGA-wxm3-qxv3-57pwCGA-x3h4-v6w8-9qjxCGA-xvwp-44wx-rg4cGHSA-c77r-fh37-x2pxGO-2024-3141CGA-4vh7-q53m-wwq4CGA-5q8g-38jp-r3cgCGA-72p4-r784-6wwrCGA-84hm-x5c4-2f5mCGA-8pcc-pgvc-fqrgCGA-fc9x-4jfg-59cjCGA-h762-v6xr-h3rqCGA-jp8x-5xjh-9x58CGA-mc5p-6565-j9gqCGA-mq64-rcpv-6qccCGA-rv74-26q5-jmwgCGA-w395-gfx9-j4f6CGA-x9jc-m7jv-hx4xCGA-xmcr-wx98-9rm4
Published 30-08-2024Last modified 30-08-2024
Vulnerability summary
CVE-2024-8260 is a high (CVSS 7.3) Authentication Bypass by Capture-replay vulnerability in openpolicyagent open_policy_agent. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.1 (NVD)EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 24CGA-29XX-PJPW-7X2RCGA-2J3J-4MM5-FPM7CGA-59Q6-6HWX-3GCFCGA-5C66-W9QR-VJ67CGA-6F94-X6V7-VQC8CGA-7V33-G2F6-4346CGA-8HJ2-X33H-JM4WCGA-8XFG-4HW5-VJCJCGA-9969-43HG-MXVGCGA-C36Q-CW7X-G24FCGA-FQV4-Q739-VPRMCGA-GQJ4-HC5G-HMVMCGA-H3GJ-F857-HXR4CGA-HFV7-8R5C-46P5CGA-JFF6-4R5M-FJCQCGA-JWRC-J899-Q434CGA-Q3XG-M96Q-M899CGA-QGWM-CRMP-W6VMCGA-RQMR-V7F6-GR6QCGA-VX3J-4CJ2-74QRCGA-WJGR-9Q9W-8787CGA-X85F-FVCJ-2JH3CGA-XG4P-JW55-G862CGA-XJJP-HRXW-9X84
Timeline
- 30-08-2024PublishedVulnerability first disclosed.
- 30-08-2024Last modifiedVulnerability information updated.
Description
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 5.2Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 7.3Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HSources5 sources · 6.1–7.3
- CVE.orgCNA6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LDiffers
- OSV · GoEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 20-09-2026
20-09-202620-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard24 products
- conftest< 0.55.0-r2
- conftest-fips< 0.55.0-r2
- cosign< 2.4.0-r4
- cosign-fips< 2.4.0-r3
- k8sgpt< 0.3.42-r1
Wolfi17 products
- conftest< 0.55.0-r2
- cosign< 2.4.0-r4
- k8sgpt< 0.3.42-r1
- kots< 1.117.2-r1
- kots-compat< 1.117.2-r1
Github.com/open-policy-agent1 product
- opa< 0.68.0
Openpolicyagent1 product
- open_policy_agent< 0.68.0
Styra1 product
- opa< v0.68.0
5 vendors · 44 products
