CVE-2024-9802mediumCWE-312

CVE-2024-9802: falha de média gravidade em Open Mainframe Project Zowe

Conformance validation endpoint discloses detail about service to unauthenticated users

Publicada em

Seguir esta CVE+ Monitorar Zowe

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Produtos afetados
Open Mainframe Project · Zowe
CVEs relacionadas — Open Mainframe Project Zowe

No mesmo produto, das mais perigosas para as menos.

CVE-2021-4314MEDIUMCVE-2021-4314EPSS 0.5%CVE-2024-6834CRITICALImperative Local Command Injection allows Activity MaskingEPSS 0.3%CVE-2021-4326LOWImperative Local Command Injection allows Activity MaskingEPSS 0.3%CVE-2024-9798MEDIUMHealth endpoint offers list of onboarded services to unauthenticated usersEPSS 0.2%CVE-2024-6833MEDIUMZowe CLI Auto-Init Leaks Credentials LocallyEPSS 0.1%