by Kastro
Paper/Archive/CVE-2024-6834

CVE-2024-6834

Open Mainframe Project Zowe — Imperative Local Command Injection allows Activity Masking

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
31
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 18.1.181 × 203.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.

Affected

ProductAffectedFixed inSource
Zowe2.4.0 – < 2.14.02.14.0CNA
zowe_api_mediation_layer2.4.0 – < 2.14.02.14.0CISA-ADP

Scores by source

Zowe (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:T/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:C/MC:H/MI:H/MA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/zowe/api-layer