CVE-2024-39891

Producto

Twilio / Authy

Vulnerabilidad

Twilio Authy Information Disclosure Vulnerability

Añadido a KEV

23 jul 2024

Remediar antes de

13 ago 2024

Uso conocido en ransomware

No

Descripción resumida

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS; https://nvd.nist.gov/vuln/detail/CVE-2024-39891