Lucene search

K
cvelistNvidiaCVELIST:CVE-2024-0113
HistoryAug 09, 2024 - 2:19 a.m.

CVE-2024-0113

2024-08-0902:19:30
CWE-35
nvidia
www.cve.org
6
nvidia mellanox os
cgi path traversal
web support
escalation of privileges
information disclosure

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.9%

NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Mellanox OS"
    ],
    "product": "Mellanox OS",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 3.11.4000"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Mellanox OS LTS"
    ],
    "product": "Mellanox OS",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 3.11.2200"
      },
      {
        "status": "affected",
        "version": "All versions prior to and including 3.10.4400"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Skyway"
    ],
    "product": "Skyway",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 8.2.2200"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Skyway LTS"
    ],
    "product": "Skyway",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 8.1.4400"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "MetroX"
    ],
    "product": "MetroX-3 XC",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 18.2.2200"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "MetroX"
    ],
    "product": "MetroX-2",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including 3.11.4000"
      }
    ]
  }
]

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.9%

Related for CVELIST:CVE-2024-0113