CVE-2024-1212 - OpenCVE

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://freeloadbalancer.com/
https://kemptechnologies.com/
https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212
https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212

History

No history.

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2024-02-21T17:39:12.599Z

Updated: 2024-08-12T19:25:10.213Z

Reserved: 2024-02-02T18:16:01.280Z

Link: CVE-2024-1212

Vulnrichment

Updated: 2024-08-01T18:33:24.842Z

NVD

Status : Awaiting Analysis

Published: 2024-02-21T18:15:50.417

Modified: 2024-02-22T19:07:27.197

Link: CVE-2024-1212

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1212", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2024-02-02T18:16:01.280Z", "datePublished": "2024-02-21T17:39:12.599Z", "dateUpdated": "2024-08-12T19:25:10.213Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["LoadMaster Management Interface"], "platforms": ["Linux"], "product": "LoadMaster", "vendor": "Progress Software", "versions": [{"lessThan": "7.2.48.10", "status": "affected", "version": "7.2.48.1", "versionType": "semver"}, {"lessThan": "7.2.54.8", "status": "affected", "version": "7.2.54.0", "versionType": "semver"}, {"lessThan": "7.2.59.2", "status": "affected", "version": "7.2.55.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Rhino Security Labs"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.</span>\n\n<br>"}], "value": "Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.\n\n\n"}], "impacts": [{"capecId": "CAPEC-113", "descriptions": [{"lang": "en", "value": "CAPEC-113 API Manipulation"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T20:45:42.781Z"}, "references": [{"tags": ["product"], "url": "https://kemptechnologies.com/"}, {"tags": ["product"], "url": "https://freeloadbalancer.com/"}, {"tags": ["vendor-advisory"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212"}, {"tags": ["vendor-advisory"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212"}], "source": {"discovery": "UNKNOWN"}, "title": "LoadMaster Pre-Authenticated OS Command Injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:24.842Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://kemptechnologies.com/"}, {"tags": ["product", "x_transferred"], "url": "https://freeloadbalancer.com/"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212"}]}, {"affected": [{"vendor": "kemptechnologies", "product": "loadmaster", "cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.2.48.1", "status": "affected", "lessThan": "7.2.48.10", "versionType": "custom"}, {"version": "7.2.54.0", "status": "affected", "lessThan": "7.2.54.8", "versionType": "custom"}, {"version": "7.2.55.0", "status": "affected", "lessThan": "7.2.59.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-29T04:00:09.778862Z", "id": "CVE-2024-1212", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T19:25:10.213Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://kemptechnologies.com/", "tags": ["product", "x_transferred"]}, {"url": "https://freeloadbalancer.com/", "tags": ["product", "x_transferred"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:24.842Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1212", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-29T04:00:09.778862Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"], "vendor": "kemptechnologies", "product": "loadmaster", "versions": [{"status": "affected", "version": "7.2.48.1", "lessThan": "7.2.48.10", "versionType": "custom"}, {"status": "affected", "version": "7.2.54.0", "lessThan": "7.2.54.8", "versionType": "custom"}, {"status": "affected", "version": "7.2.55.0", "lessThan": "7.2.59.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T19:25:05.682Z"}}], "cna": {"title": "LoadMaster Pre-Authenticated OS Command Injection", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Rhino Security Labs"}], "impacts": [{"capecId": "CAPEC-113", "descriptions": [{"lang": "en", "value": "CAPEC-113 API Manipulation"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "modules": ["LoadMaster Management Interface"], "product": "LoadMaster", "versions": [{"status": "affected", "version": "7.2.48.1", "lessThan": "7.2.48.10", "versionType": "semver"}, {"status": "affected", "version": "7.2.54.0", "lessThan": "7.2.54.8", "versionType": "semver"}, {"status": "affected", "version": "7.2.55.0", "lessThan": "7.2.59.2", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "affected"}], "references": [{"url": "https://kemptechnologies.com/", "tags": ["product"]}, {"url": "https://freeloadbalancer.com/", "tags": ["product"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212", "tags": ["vendor-advisory"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.\n\n\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.</span>\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T20:45:42.781Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1212", "state": "PUBLISHED", "dateUpdated": "2024-08-12T19:25:10.213Z", "dateReserved": "2024-02-02T18:16:01.280Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2024-02-21T17:39:12.599Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}