Lucene search

ApacheCVE-2024-27905

HistoryFeb 27, 2024 - 3:15 p.m.

CVE-2024-27905

2024-02-2715:15:07

CWE-200

apache

web.nvd.nist.gov

3541

cve-2024-27905

exposure of sensitive information

apache aurora

unauthorized actor

vulnerability

security issue

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

UNSUPPORTED WHEN ASSIGNED Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora.

An endpoint exposing internals to unauthenticated users can be used as a “padding oracle” allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected configurations

Vulners

Vulnrichment

Node

apacheauroraRange≤0.5.0

VendorProductVersionCPE
apacheaurora*cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	aurora	*	cpe:2.3:a:apache:aurora::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Aurora",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "*",
        "status": "affected",
        "version": "0.5.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2024/02/27/3

lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-27905