by Kastro
Paper/Archive/CVE-2024-0799

CVE-2024-0799

Arcserve Unified Data Protection — Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.2.912 × 2018.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.

Affected

ProductAffectedFixed inSource
Unified Data Protection≤ 9.2–CNA
Unified Data Protection≤ 8.1–CNA
arcserve_unified_data_protection9.2–CISA-ADP

Scores by source

tenable (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reftenable.com/security/research/tra-2024-07