{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dell_inspiron",
            "vendor": "elan",
            "versions": [
              {
                "lessThan": "3.0.12011.08009",
                "status": "affected",
                "version": "3.0.12011.08001",
                "versionType": "custom"
              },
              {
                "lessThan": "3.3.12011.08103",
                "status": "affected",
                "version": "3.3.12011.08101",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:07:08.650230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:10:10.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Windows Hello Identification"
          ],
          "packageName": "UMDF Driver",
          "platforms": [
            "Windows"
          ],
          "product": "DELL Inspiron",
          "vendor": "ELAN",
          "versions": [
            {
              "lessThan": "3.0.12011.08009",
              "status": "affected",
              "version": "3.0.12011.08001",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.12011.08103",
              "status": "affected",
              "version": "3.3.12011.08101",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-01-12T01:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\u003cbr\u003eThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\u003cbr\u003eVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
            }
          ],
          "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T01:48:47.887Z",
        "orgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
        "shortName": "ELAN"
      },
      "references": [
        {
          "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability on Match-on-Chip FPR Architecture",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df",
    "assignerShortName": "ELAN",
    "cveId": "CVE-2024-0454",
    "datePublished": "2024-01-12T01:48:47.887Z",
    "dateReserved": "2024-01-12T01:47:40.093Z",
    "dateUpdated": "2024-11-06T17:10:10.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}