CVE-2024-3375 - OpenCVE

Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Havelsan	Dialogue

No data.

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-24-0363

History

Thu, 26 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Havelsan Havelsan dialogue
CPEs		cpe:2.3:a:havelsan:dialogue:1.83:::::::*
Vendors & Products		Havelsan Havelsan dialogue
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-276

Thu, 26 Sep 2024 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-732

Tue, 27 Aug 2024 07:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-732

Tue, 27 Aug 2024 07:15:00 +0000

Type	Values Removed	Values Added
Description	Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.	Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.
Weaknesses		CWE-276

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2024-04-29T09:00:09.149Z

Updated: 2024-09-26T12:09:54.278Z

Reserved: 2024-04-05T13:11:35.426Z

Link: CVE-2024-3375

Vulnrichment

Updated: 2024-08-01T20:12:06.468Z

NVD

Status : Awaiting Analysis

Published: 2024-04-29T09:15:09.017

Modified: 2024-09-26T12:15:03.810

Link: CVE-2024-3375

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3375", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2024-04-05T13:11:35.426Z", "datePublished": "2024-04-29T09:00:09.149Z", "dateUpdated": "2024-09-26T12:09:54.278Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Dialogue", "vendor": "Havelsan Inc.", "versions": [{"lessThan": "v1.83.1 or v1.84", "status": "affected", "version": "v1.83", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmet Serkan ARI"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.</p>"}], "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-26T12:09:54.278Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0363"}], "source": {"advisory": "TR-24-0363", "defect": ["TR-24-0363"], "discovery": "UNKNOWN"}, "title": "Broken Access Control in Havelsan's Dialogue", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "havelsan", "product": "dialogue", "cpes": ["cpe:2.3:a:havelsan:dialogue:1.83:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.83", "status": "affected", "lessThan": "1.83.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-03T17:01:32.170683Z", "id": "CVE-2024-3375", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-03T20:58:57.582Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.468Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0363", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0363", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.468Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-03T17:01:32.170683Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:havelsan:dialogue:1.83:*:*:*:*:*:*:*"], "vendor": "havelsan", "product": "dialogue", "versions": [{"status": "affected", "version": "1.83", "lessThan": "1.83.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-03T17:08:50.701Z"}}], "cna": {"title": "Broken Access Control in Havelsan's Dialogue", "source": {"defect": ["TR-24-0363"], "advisory": "TR-24-0363", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ahmet Serkan ARI"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Havelsan Inc.", "product": "Dialogue", "versions": [{"status": "affected", "version": "v1.83", "lessThan": "v1.83.1 or v1.84", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0363"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-26T12:09:54.278Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3375", "state": "PUBLISHED", "dateUpdated": "2024-09-26T12:09:54.278Z", "dateReserved": "2024-04-05T13:11:35.426Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2024-04-29T09:00:09.149Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}