Lucene search

1ECVE-2024-7211

HistoryAug 01, 2024 - 5:16 p.m.

CVE-2024-7211

2024-08-0117:16:09

CWE-601

web.nvd.nist.gov

identity server

1e platform

url redirection

untrusted sites

patch

cve-2024-7211

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

The 1E Platform’s component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users.

Note: 1E Platform’s component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix.

Affected configurations

Nvd

Node

1eplatformMatch8.4.1.229

1eplatformMatch23.7.1.80

1eplatformMatch23.11.1.15

1eplatformMatch24.7

VendorProductVersionCPE
1eplatform8.4.1.229cpe:2.3:a:1e:platform:8.4.1.229:*:*:*:*:*:*:*
1eplatform23.7.1.80cpe:2.3:a:1e:platform:23.7.1.80:*:*:*:*:*:*:*
1eplatform23.11.1.15cpe:2.3:a:1e:platform:23.11.1.15:*:*:*:*:*:*:*
1eplatform24.7cpe:2.3:a:1e:platform:24.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
1e	platform	8.4.1.229	cpe:2.3:a:1e:platform:8.4.1.229:::::::*
1e	platform	23.7.1.80	cpe:2.3:a:1e:platform:23.7.1.80:::::::*
1e	platform	23.11.1.15	cpe:2.3:a:1e:platform:23.11.1.15:::::::*
1e	platform	24.7	cpe:2.3:a:1e:platform:24.7:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "1E Platform",
    "vendor": "1E",
    "versions": [
      {
        "status": "affected",
        "version": "24.7"
      },
      {
        "status": "affected",
        "version": "23.11.1.15"
      },
      {
        "status": "affected",
        "version": "23.7.1.80"
      },
      {
        "status": "affected",
        "version": "8.4.1.229"
      }
    ]
  }
]

References

www.1e.com/trust-security-compliance/cve-info/

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-7211