CVE-2024-50618

A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*

History

17 Jun 2026, 08:04

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso de autenticación de un solo factor en el componente de autenticación de CIPPlanner CIPAce anterior a 9.17 permite a los atacantes eludir un mecanismo de protección. Cuando el sistema está configurado para permitir el inicio de sesión con cuentas internas, un atacante puede posiblemente obtener autenticación completa si el secreto en un esquema de autenticación de un solo factor se ve comprometido.

17 Feb 2026, 15:01

Type	Values Removed	Values Added
References	~~() https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/ -~~	() https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/ - Vendor Advisory
First Time		Cipplanner cipace Cipplanner
CPE		cpe:2.3:a:cipplanner:cipace::::::::

12 Feb 2026, 22:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CWE		CWE-308

11 Feb 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-11 20:16

Updated : 2026-06-17 08:04

NVD link : CVE-2024-50618

Mitre link : CVE-2024-50618

CVE.ORG link : CVE-2024-50618

JSON object : View

Products Affected

cipplanner

cipace

CWE

CWE-308

Use of Single-factor Authentication

{"id": "CVE-2024-50618", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50618", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T21:04:53.651539Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-11T20:16:07.017", "references": [{"url": "https://cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-308"}]}], "descriptions": [{"lang": "en", "value": "A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised."}, {"lang": "es", "value": "Una vulnerabilidad de uso de autenticaci\u00f3n de un solo factor en el componente de autenticaci\u00f3n de CIPPlanner CIPAce anterior a 9.17 permite a los atacantes eludir un mecanismo de protecci\u00f3n. Cuando el sistema est\u00e1 configurado para permitir el inicio de sesi\u00f3n con cuentas internas, un atacante puede posiblemente obtener autenticaci\u00f3n completa si el secreto en un esquema de autenticaci\u00f3n de un solo factor se ve comprometido."}], "lastModified": "2026-06-17T08:04:49.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5F8D48-AC37-455A-A9AC-7950E70027D7", "versionEndExcluding": "9.17"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}