CVE-2024-35118 - OpenCVE

IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Maas360 Maas360 Mdm

Configuration 1 [-]

cpe:2.3:a:ibm:maas360_mdm:*:*:*:*:*:android:*:*

No data.

References

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/290341
https://www.ibm.com/support/pages/node/7166750

History

Thu, 19 Sep 2024 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ibm maas360 Mdm
CPEs	cpe:2.3:a:ibm:maas360::::::android::*	cpe:2.3:a:ibm:maas360_mdm::::::android::*
Vendors & Products		Ibm maas360 Mdm

Thu, 19 Sep 2024 16:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ibm:maas360::::::android::*

Thu, 29 Aug 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 29 Aug 2024 15:30:00 +0000

Type	Values Removed	Values Added
Description		IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device.
Title		IBM MaaS360 information disclosure
First Time appeared		Ibm Ibm maas360
Weaknesses		CWE-798
CPEs		cpe:2.3:a:ibm:maas360:6.31:::::android:: cpe:2.3:a:ibm:maas360:8.60:::::android::
Vendors & Products		Ibm Ibm maas360
References		https://exchange.xforce.ibmcloud.com/vulnerabilities/290341 https://www.ibm.com/support/pages/node/7166750
Metrics		cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-08-29T15:20:02.246Z

Updated: 2024-08-29T15:38:39.100Z

Reserved: 2024-05-09T16:27:02.679Z

Link: CVE-2024-35118

Vulnrichment

Updated: 2024-08-29T15:38:34.716Z

NVD

Status : Analyzed

Published: 2024-08-29T16:15:08.613

Modified: 2024-09-19T15:53:25.123

Link: CVE-2024-35118

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35118", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-05-09T16:27:02.679Z", "datePublished": "2024-08-29T15:20:02.246Z", "dateUpdated": "2024-08-29T15:38:39.100Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:maas360:6.31:*:*:*:*:android:*:*", "cpe:2.3:a:ibm:maas360:8.60:*:*:*:*:android:*:*"], "defaultStatus": "unaffected", "platforms": ["Android"], "product": "MaaS360", "vendor": "IBM", "versions": [{"lessThanOrEqual": "8.60", "status": "affected", "version": "6.31", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device."}], "value": "IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-08-29T15:20:02.246Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7166750"}, {"tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290341"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM MaaS360 information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-29T15:34:49.112587Z", "id": "CVE-2024-35118", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:38:39.100Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35118", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-05-09T16:27:02.679Z", "datePublished": "2024-08-29T15:20:02.246Z", "dateUpdated": "2024-08-29T15:38:39.100Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:maas360:6.31:*:*:*:*:android:*:*", "cpe:2.3:a:ibm:maas360:8.60:*:*:*:*:android:*:*"], "defaultStatus": "unaffected", "platforms": ["Android"], "product": "MaaS360", "vendor": "IBM", "versions": [{"lessThanOrEqual": "8.60", "status": "affected", "version": "6.31", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device."}], "value": "IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-08-29T15:20:02.246Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7166750"}, {"tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290341"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM MaaS360 information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-29T15:34:49.112587Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:38:34.716Z"}}]}}