CVE-2024-42340 - Vulnerability Details

Vendors	Products
Cyberark	Identity

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-Other

Type	Values Removed	Values Added
First Time appeared		Cyberark Cyberark identity
CPEs		cpe:2.3:a:cyberark:identity::::::::
Vendors & Products		Cyberark Cyberark identity
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
Title		CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
Weaknesses		CWE-602
References		https://www.gov.il/en/Departments/faq/cve_advisories
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42340", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-07-30T09:20:10.447Z", "datePublished": "2024-08-25T07:12:05.219Z", "dateUpdated": "2024-08-26T19:18:05.719Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CyberArk Identity Management", "vendor": "CyberArk", "versions": [{"lessThan": "Upgrade to latest version", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Dudu Moyal, Moriel Harush - Peer Security LTD"}], "datePublic": "2024-08-25T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security<br>"}], "value": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-25T07:12:05.219Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to latest version</span>\n\n<br>"}], "value": "Upgrade to latest version"}], "source": {"advisory": "ILVN-2024-0193", "discovery": "UNKNOWN"}, "title": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "cyberark", "product": "identity", "cpes": ["cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "24.8", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-26T19:12:54.293755Z", "id": "CVE-2024-42340", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T19:18:05.719Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-42340 (string)

assignerOrgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

state : PUBLISHED (string)

assignerShortName : INCD (string)

dateReserved : 2024-07-30T09:20:10.447Z (string)

datePublished : 2024-08-25T07:12:05.219Z (string)

dateUpdated : 2024-08-26T19:18:05.719Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : CyberArk Identity Management (string)

vendor : CyberArk (string)

versions : [ »

0 : { »

lessThan : Upgrade to latest version (string)

status : affected (string)

version : All versions (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Dudu Moyal, Moriel Harush - Peer Security LTD (string)

}

]

datePublic : 2024-08-25T07:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

}

]

value : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 8.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-602 (string)

description : CWE-602: Client-Side Enforcement of Server-Side Security (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

shortName : INCD (string)

dateUpdated : 2024-08-25T07:12:05.219Z (string)

}

references : [ »

0 : { »

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Upgrade to latest version (string)

}

]

value : Upgrade to latest version (string)

}

]

source : { »

advisory : ILVN-2024-0193 (string)

discovery : UNKNOWN (string)

}

title : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : cyberark (string)

product : identity (string)

cpes : [ »

0 : cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 24.8 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-26T19:12:54.293755Z (string)

id : CVE-2024-42340 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-26T19:18:05.719Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-26T19:12:54.293755Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*"], "vendor": "cyberark", "product": "identity", "versions": [{"status": "affected", "version": "0", "lessThan": "24.8", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T19:17:23.843Z"}}], "cna": {"title": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security", "source": {"advisory": "ILVN-2024-0193", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Dudu Moyal, Moriel Harush - Peer Security LTD"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CyberArk", "product": "CyberArk Identity Management", "versions": [{"status": "affected", "version": "All versions", "lessThan": "Upgrade to latest version", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to latest version", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to latest version</span>\n\n<br>", "base64": false}]}], "datePublic": "2024-08-25T07:00:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security", "supportingMedia": [{"type": "text/html", "value": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-25T07:12:05.219Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42340", "state": "PUBLISHED", "dateUpdated": "2024-08-26T19:18:05.719Z", "dateReserved": "2024-07-30T09:20:10.447Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-08-25T07:12:05.219Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-42340 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-26T19:12:54.293755Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:* (string)

]

vendor : cyberark (string)

product : identity (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 24.8 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-26T19:17:23.843Z (string)

}

]

cna : { »

title : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

source : { »

advisory : ILVN-2024-0193 (string)

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Dudu Moyal, Moriel Harush - Peer Security LTD (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.3 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : CyberArk (string)

product : CyberArk Identity Management (string)

versions : [ »

0 : { »

status : affected (string)

version : All versions (string)

lessThan : Upgrade to latest version (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Upgrade to latest version (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Upgrade to latest version (string)

base64 : false (boolean)

}

]

}

]

datePublic : 2024-08-25T07:00:00.000Z (string)

references : [ »

0 : { »

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-602 (string)

description : CWE-602: Client-Side Enforcement of Server-Side Security (string)

}

]

}

]

providerMetadata : { »

orgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

shortName : INCD (string)

dateUpdated : 2024-08-25T07:12:05.219Z (string)

}

cveMetadata : { »

cveId : CVE-2024-42340 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-26T19:18:05.719Z (string)

dateReserved : 2024-07-30T09:20:10.447Z (string)

assignerOrgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

datePublished : 2024-08-25T07:12:05.219Z (string)

assignerShortName : INCD (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*", "matchCriteriaId": "05F3B3BD-6311-4715-A14E-F12BFAC1C7B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security"}, {"lang": "es", "value": "CyberArk - CWE-602: Aplicaci\u00f3n de la seguridad del lado del cliente en el lado del servidor"}], "id": "CVE-2024-42340", "lastModified": "2024-08-30T19:47:36.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "cna@cyber.gov.il", "type": "Secondary"}]}, "published": "2024-08-25T08:15:03.290", "references": [{"source": "cna@cyber.gov.il", "tags": ["Third Party Advisory"], "url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "sourceIdentifier": "cna@cyber.gov.il", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-602"}], "source": "cna@cyber.gov.il", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 05F3B3BD-6311-4715-A14E-F12BFAC1C7B4 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (string)

}

1 : { »

lang : es (string)

value : CyberArk - CWE-602: Aplicación de la seguridad del lado del cliente en el lado del servidor (string)

}

]

id : CVE-2024-42340 (string)

lastModified : 2024-08-30T19:47:36.000 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 8.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.5 (number)

source : cna@cyber.gov.il (string)

type : Secondary (string)

}

]

}

published : 2024-08-25T08:15:03.290 (string)

references : [ »

0 : { »

source : cna@cyber.gov.il (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

sourceIdentifier : cna@cyber.gov.il (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-Other (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-602 (string)

}

]

source : cna@cyber.gov.il (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object