CVE-2024-42336 - Vulnerability Details - OpenCVE

Servision - CWE-287: Improper Authentication

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00234.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Servision	Ivg Webmax

Configuration 1 [-]

cpe:2.3:a:servision:ivg_webmax:1.0.57:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-39554	Servision - CWE-287: Improper Authentication

Fixes

Solution

Product is EOL. Upgrade to a newer version or limit access to web management port

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

Tue, 27 Aug 2024 15:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:servision:ivg_webmax:1.0.57:::::::*

Tue, 20 Aug 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Servision Servision ivg Webmax
CPEs		cpe:2.3:a:servision:ivg_webmax::::::::
Vendors & Products		Servision Servision ivg Webmax
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 Aug 2024 12:45:00 +0000

Type	Values Removed	Values Added
Description		Servision - CWE-287: Improper Authentication
Title		Servision - CWE-287: Improper Authentication
Weaknesses		CWE-287
References		https://www.gov.il/en/Departments/faq/cve_advisories
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: INCD

Published: 2024-08-20T12:26:28.120Z

Updated: 2024-08-20T13:29:46.227Z

Reserved: 2024-07-30T09:20:10.447Z

Link: CVE-2024-42336

Vulnrichment

Updated: 2024-08-20T13:29:18.697Z

NVD

Status : Analyzed

Published: 2024-08-20T13:15:05.617

Modified: 2024-08-27T14:59:38.100

Link: CVE-2024-42336

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42336", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-07-30T09:20:10.447Z", "datePublished": "2024-08-20T12:26:28.120Z", "dateUpdated": "2024-08-20T13:29:46.227Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Servision IVG Webmax 1.0.57", "vendor": "Servision", "versions": [{"lessThan": "Upgrade to a newer version or limit access to web management port", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Aviv Vinograzki"}], "datePublic": "2024-08-20T11:49:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Servision - CWE-287: Improper Authentication"}], "value": "Servision - CWE-287: Improper Authentication"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-20T12:26:28.120Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<div><div><div><div><div><div>Product is EOL. Upgrade to a newer version or limit access to web management port</div></div></div></div></div></div>\n\n<br></div>"}], "value": "Product is EOL. Upgrade to a newer version or limit access to web management port"}], "source": {"advisory": "ILVN-2024-0189", "discovery": "UNKNOWN"}, "title": "Servision - CWE-287: Improper Authentication", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "servision", "product": "ivg_webmax", "cpes": ["cpe:2.3:a:servision:ivg_webmax:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.57", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-20T13:25:33.257520Z", "id": "CVE-2024-42336", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T13:29:46.227Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42336", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-20T13:25:33.257520Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:servision:ivg_webmax:*:*:*:*:*:*:*:*"], "vendor": "servision", "product": "ivg_webmax", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.57", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T13:29:18.697Z"}}], "cna": {"title": "Servision - CWE-287: Improper Authentication", "source": {"advisory": "ILVN-2024-0189", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Aviv Vinograzki"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Servision", "product": "Servision IVG Webmax 1.0.57", "versions": [{"status": "affected", "version": "All versions", "lessThan": "Upgrade to a newer version or limit access to web management port", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Product is EOL. Upgrade to a newer version or limit access to web management port", "supportingMedia": [{"type": "text/html", "value": "<div>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<div><div><div><div><div><div>Product is EOL. Upgrade to a newer version or limit access to web management port</div></div></div></div></div></div>\n\n<br></div>", "base64": false}]}], "datePublic": "2024-08-20T11:49:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Servision - CWE-287: Improper Authentication", "supportingMedia": [{"type": "text/html", "value": "Servision - CWE-287: Improper Authentication", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-20T12:26:28.120Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42336", "state": "PUBLISHED", "dateUpdated": "2024-08-20T13:29:46.227Z", "dateReserved": "2024-07-30T09:20:10.447Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-08-20T12:26:28.120Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}