CVE-2024-4332 - CVE House

Back to Database

Status published Critical CVE-2024-4332

Improper Authentication in Tripwire Enterprise 9.1.0 APIs

9.3 CVSS

Vulnerability Description

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-4332

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.fortra.com/security/advisory/fi-2024-006

More from Fortra

View All →

Unrestricted File Upload in FileCatalyst

CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT

Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache

Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

Affected Vendor

Fortra

View all reports →

Affected Software

Tripwire Enterprise

Vulnerable Versions:

9.1.0

Timeline

Official Publish: June 3rd, 2024

Last Modified: August 29th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-303 CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement