CVE-2024-9160 - Vulnerability Details - OpenCVE

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.

Attack Vector Local

Attack Complexity High

Privileges Required High

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://portal.perforce.com/s/detail/a91PA000001SXN3YAO

History

Fri, 27 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Sep 2024 19:15:00 +0000

Type	Values Removed	Values Added
Description		In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.
Title		Security Misconfiguration in Forge module PEADM
Weaknesses		CWE-295
References		https://portal.perforce.com/s/detail/a91PA000001SXN3YAO
Metrics		cvssV4_0 `{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2024-09-27T18:58:43.352Z

Updated: 2024-09-27T19:25:45.709Z

Reserved: 2024-09-24T17:50:17.099Z

Link: CVE-2024-9160

Vulnrichment

Updated: 2024-09-27T19:25:35.527Z

NVD

Status : Awaiting Analysis

Published: 2024-09-27T19:15:10.733

Modified: 2024-09-30T12:45:57.823

Link: CVE-2024-9160

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9160", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2024-09-24T17:50:17.099Z", "datePublished": "2024-09-27T18:58:43.352Z", "dateUpdated": "2024-09-27T19:25:45.709Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PEADM Forge Module", "vendor": "Puppet", "versions": [{"lessThan": "3.24.0", "status": "affected", "version": "3.8.0", "versionType": "sem"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In versions of the PEADM Forge Module </span><span style=\"background-color: rgb(255, 255, 255);\">prior to</span><span style=\"background-color: rgb(255, 255, 255);\"> 3.2</span><span style=\"background-color: rgb(255, 255, 255);\">4</span><span style=\"background-color: rgb(255, 255, 255);\">.0 a security misconfiguration was discovered. </span><br>"}], "value": "In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.4, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2024-09-27T18:59:46.375Z"}, "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SXN3YAO"}], "source": {"discovery": "UNKNOWN"}, "title": "Security Misconfiguration in Forge module PEADM", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-27T19:25:28.303072Z", "id": "CVE-2024-9160", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T19:25:45.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9160", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-27T19:25:28.303072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T19:25:35.527Z"}}], "cna": {"title": "Security Misconfiguration in Forge module PEADM", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Puppet", "product": "PEADM Forge Module", "versions": [{"status": "affected", "version": "3.8.0", "lessThan": "3.24.0", "versionType": "sem"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SXN3YAO"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In versions of the PEADM Forge Module </span><span style=\"background-color: rgb(255, 255, 255);\">prior to</span><span style=\"background-color: rgb(255, 255, 255);\"> 3.2</span><span style=\"background-color: rgb(255, 255, 255);\">4</span><span style=\"background-color: rgb(255, 255, 255);\">.0 a security misconfiguration was discovered. </span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2024-09-27T18:59:46.375Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9160", "state": "PUBLISHED", "dateUpdated": "2024-09-27T19:25:45.709Z", "dateReserved": "2024-09-24T17:50:17.099Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2024-09-27T18:58:43.352Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered."}, {"lang": "es", "value": "En versiones del m\u00f3dulo PEADM Forge anteriores a 3.24.0 se descubri\u00f3 una configuraci\u00f3n de seguridad incorrecta."}], "id": "CVE-2024-9160", "lastModified": "2024-09-30T12:45:57.823", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "security@puppet.com", "type": "Secondary"}]}, "published": "2024-09-27T19:15:10.733", "references": [{"source": "security@puppet.com", "url": "https://portal.perforce.com/s/detail/a91PA000001SXN3YAO"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@puppet.com", "type": "Secondary"}]}