CVE-2024-3046

2024-04-0910:15:08

CWE-303

[email protected]

web.nvd.nist.gov

eclipse kura

logservlet

unauthenticated access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs.

This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1]

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "org.eclipse.kura:org.eclipse.kura.web2",
    "product": "Kura",
    "repo": "https://github.com/eclipse/kura",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThanOrEqual": "5.4.1",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "semver"
      }
    ]
  }
]