by Kastro
Paper/Archive/CVE-2024-47857

CVE-2024-47857

mitre — SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native…

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.6.396 × 207.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another existing PrivX "account B" and gain access to SSH target hosts to which the "account B" has access.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refssh.comrefinfo.ssh.com/impersonation-vulnerability-privx