{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9802", "assignerOrgId": "b1336bef-059d-4e13-b11b-9a6ef21b3c78", "state": "PUBLISHED", "assignerShortName": "Zowe", "dateReserved": "2024-10-10T07:41:03.236Z", "datePublished": "2024-10-10T07:41:03.374Z", "dateUpdated": "2024-10-10T14:22:43.244Z"}, "containers": {"cna": {"title": "Conformance validation endpoint discloses detail about service to unauthenticated users", "affected": [{"vendor": "Open Mainframe Project", "product": "Zowe", "versions": [{"version": "2.11.0", "status": "affected", "lessThan": "2.17.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "There is a fix since version 2.17.0, authentication is required for the endpoints."}], "workarounds": [{"lang": "en", "value": "No workaround is available."}], "exploits": [{"lang": "en", "value": "There are no known exploits of this issue however exploits targeting this issue are publicly available."}], "credits": [{"lang": "en", "value": "Pablo Hernan Carle", "type": "finder"}, {"lang": "en", "value": "Pavel Jare\u0161", "type": "finder"}], "providerMetadata": {"orgId": "b1336bef-059d-4e13-b11b-9a6ef21b3c78", "shortName": "Zowe", "dateUpdated": "2024-10-10T07:41:03.374Z"}, "references": [{"tags": ["product"], "url": "https://github.com/zowe/api-layer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-312", "lang": "en", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "affected": [{"vendor": "linuxfoundation", "product": "zowe_api_mediation_layer", "cpes": ["cpe:2.3:a:linuxfoundation:zowe_api_mediation_layer:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.11.0", "status": "affected", "lessThan": "2.17.0", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-10T13:45:19.081095Z", "id": "CVE-2024-9802", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-10T14:22:43.244Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9802", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-10T13:45:19.081095Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:linuxfoundation:zowe_api_mediation_layer:*:*:*:*:*:*:*:*"], "vendor": "linuxfoundation", "product": "zowe_api_mediation_layer", "versions": [{"status": "affected", "version": "2.11.0", "lessThan": "2.17.0", "versionType": "semver"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-10T13:50:58.056Z"}}], "cna": {"title": "Conformance validation endpoint discloses detail about service to unauthenticated users", "credits": [{"lang": "en", "type": "finder", "value": "Pablo Hernan Carle"}, {"lang": "en", "type": "finder", "value": "Pavel Jare\u0161"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Open Mainframe Project", "product": "Zowe", "versions": [{"status": "affected", "version": "2.11.0", "lessThan": "2.17.0", "versionType": "semver"}]}], "exploits": [{"lang": "en", "value": "There are no known exploits of this issue however exploits targeting this issue are publicly available."}], "solutions": [{"lang": "en", "value": "There is a fix since version 2.17.0, authentication is required for the endpoints."}], "references": [{"url": "https://github.com/zowe/api-layer", "tags": ["product"]}], "workarounds": [{"lang": "en", "value": "No workaround is available."}], "descriptions": [{"lang": "en", "value": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running."}], "providerMetadata": {"orgId": "b1336bef-059d-4e13-b11b-9a6ef21b3c78", "shortName": "Zowe", "dateUpdated": "2024-10-10T07:41:03.374Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9802", "state": "PUBLISHED", "dateUpdated": "2024-10-10T14:22:43.244Z", "dateReserved": "2024-10-10T07:41:03.236Z", "assignerOrgId": "b1336bef-059d-4e13-b11b-9a6ef21b3c78", "datePublished": "2024-10-10T07:41:03.374Z", "assignerShortName": "Zowe"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:zowe_api_mediation_layer:*:*:*:*:*:*:*:*", "matchCriteriaId": "454F6E4D-504F-4080-95F4-4D0A771C52D3", "versionEndExcluding": "2.17.0", "versionStartIncluding": "2.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running."}, {"lang": "es", "value": "El endpoint de validaci\u00f3n de conformidad es p\u00fablico, por lo que todos pueden verificar la conformidad de los servicios incorporados. La respuesta podr\u00eda contener informaci\u00f3n espec\u00edfica sobre el servicio, incluidos los endpoints disponibles y swagger. Podr\u00eda informar a un atacante sobre la versi\u00f3n en ejecuci\u00f3n de un servicio. El atacante tambi\u00e9n podr\u00eda verificar si un servicio est\u00e1 en ejecuci\u00f3n."}], "id": "CVE-2024-9802", "lastModified": "2024-12-19T17:00:21.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "zowe-security@lists.openmainframeproject.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-10-10T08:15:04.387", "references": [{"source": "zowe-security@lists.openmainframeproject.org", "tags": ["Product"], "url": "https://github.com/zowe/api-layer"}], "sourceIdentifier": "zowe-security@lists.openmainframeproject.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}