CIPPlanner CIPAce Single-Factor Authentication Bypass Vulnerability

A vulnerability allowing the bypass of single-factor authentication has been identified in the Authentication component of CIPPlanner CIPAce software, prior to version 9.17. This vulnerability arises when the system permits login with internal accounts, potentially allowing an attacker to gain full authentication if the authentication secret is compromised.

Impact

Exploitation of this vulnerability could lead to unauthorized authentication, allowing attackers to gain access to user accounts and associated privileges.

Remediation

CIPPlanner has developed and distributed software patches to customers. These patches are included in CIPAce versions 10.0 and later. For customers not currently upgrading to version 10.0, instructions for applying the patch have been provided.