Back

CVE-2024-6658

Sept. 12, 2024, 6:14 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

LoadMaster

  • 7.2.55.0 - 7.2.60.0
  • 7.2.49.0 - 7.2.54.11
  • 7.2.48.12 and older

Multi-Tenant Hypervisor

  • 7.1.35.11 and older

ECS

  • prior to 7.2.60.0

Source

security@progress.com

Tags

CWE-20
security@progress.com
2024-09-12
CVE-2024-6658

CVE-2024-6658 details

Published : Sept. 12, 2024, 3:18 p.m.
Last Modified : Sept. 12, 2024, 6:14 p.m.

Description

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: ?Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.0 (inclusive) ?  From 7.2.49.0 to 7.2.54.11 (inclusive) ?  7.2.48.12 and all prior versions Multi-Tenant Hypervisor 7.1.35.11 and all prior versions ECS All prior versions to 7.2.60.0 (inclusive)

CVSS Score

1 2 3 4 5 6 7 8.4 9 10

Weakness

Weakness Name Description
CWE-20 Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVSS Data

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.4

Exploitability Score

1.7

Impact Score

6.0

Base Severity

HIGH

Vector String : CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

URL Source
https://support.kemptechnologies.com/hc/en-us/articles/28910587250701 security@progress.com
This website uses the NVD API, but is not approved or certified by it.