GitHub Advisoryadvisory · Maven

GHSA-frc2-w2cc-x794 Eclipse Kura LogServlet vulnerability

HIGH Published 2024-04-09 Modified 2024-04-15 Official page ↗
Aliases
CVE-2024-3046
Ecosystem
Maven
Packages
org.eclipse.kura:org.eclipse.kura.web2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-303
Reviewed
2024-04-09

Affected packages

• Maven org.eclipse.kura:org.eclipse.kura.web2: >= 2.0.600, <= 2.4.0 (no fix yet)

Description

In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs. This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1].

Related

Alias · CVE (1)

  • CVE-2024-3046 In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an… vulnerability

Weakness · CWE (1)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References