Advance Authentication and CVE-2024-6531

Products

• CA Strong Authentication

Issue/Introduction

Is Advance Authentication impacted by CVE-2024-6531

Advance Authentication makes use of many JavaScript Libraries, some of these are outdated and needs to be updated. 

In a recent vulnerablity scan the findings are "The application uses a number of outdated JavaScript libraries to provide required functionality. The versions of these libraries in use are affected by known security issues, which could leave the application at risk of attack through vectors such as cross-site scripting (XSS). The affected JavaScript libraries are as follows:

bootstrap version 4.6.0.min https://getbootstrap.com/docs/4.6/getting-started/introduction/
RP: The outdated JavaScript libraries should be updated to the latest stable versions, which at the time of writing this report are Bootstrap 5.3.3.
For further information on the issues affecting the listed versions of these libraries, please refer to the following resources: https://nvd.nist.gov/vuln/detail/CVE-2024-6531 

Environment

CA Advance Authentication 9.1.04

Cause

The scan being very generic in nature, and does not share the version of the JavaScript libraries, a further investigation into the code was performed for knowing the version of the bootstrap version being used in Advance Authentication.

Resolution

As per the notes shared regarding the vulnerability in the URL https://www.herodevs.com/vulnerability-directory/cve-2024-6531 the versions of bootstrap that are impacted are ">=4.0.0 <=4.6.2". Advanced Authentication doesn't use BootStarp in any of the modules, hence Advanced Authentication is not impacted by the vulnerability described in the CVE-2024-6531.

Additional Information

Details about the Vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2024-6531

https://www.herodevs.com/vulnerability-directory/cve-2024-6531