CVE-2024-47520: falha de alta gravidade em Arista Edge Threat Management
A user with advanced report application access rights can perform actions for which they are not authorized
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.4%
A user with advanced report application access rights can perform actions for which they are not authorized
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Produtos afetados
Arista Networks · Arista Edge Threat ManagementCVEs relacionadas — Arista Edge Threat Management
No mesmo produto, das mais perigosas para as menos.
CVE-2024-9131HIGHA user with administrator privileges can perform command injectionEPSS 1.4%CVE-2024-9132HIGHThe administrator is able to configure an insecure captive portal scriptEPSS 0.7%CVE-2024-9134HIGHMultiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.EPSS 0.6%CVE-2024-9188HIGHSpecially constructed queries cause cross platform scripting leaking administrator tokensEPSS 0.5%CVE-2024-47518MEDIUMSpecially constructed queries targeting ETM could discover active remote access sessionsEPSS 0.4%CVE-2024-47517MEDIUMExpired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessEPSS 0.4%