CVE-2024-28029

Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:deltaww:diaenergie:*:*:*:*:*:*:*:*

History

25 Mar 2024, 16:06

Type	Values Removed	Values Added
CPE		cpe:2.3:a:deltaww:diaenergie::::::::
CWE		NVD-CWE-Other
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12 - Third Party Advisory, US Government Resource
First Time		Deltaww diaenergie Deltaww

22 Mar 2024, 12:45

Type	Values Removed	Values Added
Summary		(es) Los privilegios no se verifican completamente en el lado del servidor, lo que puede ser abusado por un usuario con privilegios limitados para eludir la autorización y acceder a funciones privilegiadas.

21 Mar 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-21 22:15

Updated : 2024-03-25 16:06

NVD link : CVE-2024-28029

Mitre link : CVE-2024-28029

CVE.ORG link : CVE-2024-28029

JSON object : View

Products Affected

deltaww

diaenergie

CWE

NVD-CWE-Other CWE-285

Improper Authorization

{"id": "CVE-2024-28029", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"safety": "NOT DEFINED", "version": "4.0", "recovery": "NOT DEFINED", "baseScore": 0.0, "automatable": "NOT DEFINED ", "attackVector": "NETWORK", "baseSeverity": "NONE", "valueDensity": "NOT DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:H/IR:H/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT DEFINED", "providerUrgency": "NOT DEFINED ", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT DEFINED", "integrityRequirements": "HIGH", "modifiedUserInteraction": "NOT DEFINED", "modifiedAttackComplexity": "NOT DEFINED", "Availability Requirements": "NOT DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT DEFINED", "modifiedPrivilegesRequired": "NOT DEFINED", "confidentialityRequirements": "HIGH", "vulnerabilityResponseEffort": "NOT DEFINED ", "subsequentSystemAvailability": "HIGH", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT DEFINED", "modifiedVulnerableSystemIntegrity": "NOT DEFINED", "modifiedSubsequentSystemAvailability": "NOT DEFINED", "Modified Vulnerable System Availability": "NOT DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT DEFINED"}, "impactScore": 0.0, "exploitabilityScore": 0.0}]}, "published": "2024-03-21T22:15:11.353", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "\nPrivileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.\n\n"}, {"lang": "es", "value": "Los privilegios no se verifican completamente en el lado del servidor, lo que puede ser abusado por un usuario con privilegios limitados para eludir la autorizaci\u00f3n y acceder a funciones privilegiadas."}], "lastModified": "2024-03-25T16:06:44.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:diaenergie:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AC96D25-8B44-4093-B30E-050C6F93A507", "versionEndExcluding": "1.10.00.005"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}