The vulnerability of the MonitoringMiddleTier service of the Vault Enterprise platform for archiving corporate information allows a perpetrator to execute arbitrary code.

🗓️ 27 Jan 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Deserialization flaw in Vault MonitoringMiddleTier enables code execution via crafted data.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-53909	24 Nov 202420:58	–	circl
CNNVD	Veritas Enterprise Vault 安全漏洞	24 Nov 202400:00	–	cnnvd
CVE	CVE-2024-53909	24 Nov 202400:00	–	cve
Cvelist	CVE-2024-53909	24 Nov 202400:00	–	cvelist
EUVD	EUVD-2024-52181	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities discovered in Veritas Enterprise Vault	25 Nov 202409:04	–	ncsc
NVD	CVE-2024-53909	24 Nov 202421:15	–	nvd
OSV	CVE-2024-53909	24 Nov 202421:15	–	osv
Positive Technologies	PT-2024-10286 · Veritas · Veritas Enterprise Vault	24 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-53909	4 Feb 202522:19	–	redhatcve

Vulners

Node

hashicorp vault_enterpriseMatch15.1

OR

hashicorp vault_enterpriseRange15.0–15.0.2

OR

hashicorp vault_enterpriseRange14.5–14.5.1

OR

hashicorp vault_enterpriseRange14.4–14.4.2

OR

hashicorp vault_enterpriseRange14.3–14.3.2

OR

hashicorp vault_enterpriseRange14.2–14.2.3

OR

hashicorp vault_enterpriseRange14.1.1–14.1.3

OR

hashicorp vault_enterpriseMatch14.1

OR

hashicorp vault_enterpriseMatch14.0.1

OR

hashicorp vault_enterpriseMatch14.0

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-CAN-24334
veritas	www.veritas.com/content/support/en_US/security/VTS24-014
web	www.web.nvd.nist.gov/view/vuln/detail
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-1669/

27 Jan 2025 00:00Current

8High risk

Vulners AI Score8

CVSS 39.8

CVSS 210

EPSS0.00907

deserialization flaw vault monitoringmiddletier arbitrary code execution crafted data archiving corporate information enterprise platform