Products
Cato Networks SDP Client on Windows
- before 5.10.34
Source
2505284f-8ffb-486c-bf60-e19c1097a90b
Tags
CVE-2024-6977 details
Published : July 31, 2024, 5:15 p.m.
Last Modified : July 31, 2024, 5:15 p.m.
Last Modified : July 31, 2024, 5:15 p.m.
Description
A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.5 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Base Score
6.5
Exploitability Score
2.0
Impact Score
4.0
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
| URL | Source |
|---|---|
| https://support.catonetworks.com/hc/en-us/articles/19766795729437-CVE-2024-6977-Windows-SDP-Client-Sensitive-data-in-trace-logs-can-lead-to-account-takeover | 2505284f-8ffb-486c-bf60-e19c1097a90b |
This website uses the NVD API, but is not approved or certified by it.