CVE-2024-45718 - Vulnerability Details - OpenCVE

Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00017.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

SolarWinds recommends customers upgrade to SolarWinds Kiwi Syslog NG 1.3.1 as soon as it becomes available.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0001}`	epss `{'score': 0.00013}`

Tue, 11 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Feb 2025 07:30:00 +0000

Type	Values Removed	Values Added
Description		Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.
Title		Sensitive data disclosure vulnerability
Weaknesses		CWE-312
References		https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718
Metrics		cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SolarWinds

Published: 2025-02-11T07:19:21.975Z

Updated: 2025-02-11T15:12:15.783Z

Reserved: 2024-09-05T08:28:03.888Z

Link: CVE-2024-45718

Vulnrichment

Updated: 2025-02-11T15:11:59.632Z

NVD

Status : Received

Published: 2025-02-11T08:15:30.953

Modified: 2025-02-11T08:15:30.953

Link: CVE-2024-45718

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45718", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "state": "PUBLISHED", "assignerShortName": "SolarWinds", "dateReserved": "2024-09-05T08:28:03.888Z", "datePublished": "2025-02-11T07:19:21.975Z", "dateUpdated": "2025-02-11T15:12:15.783Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Kiwi Syslog NG", "vendor": "SolarWinds", "versions": [{"status": "affected", "version": "Kiwi 1.3 and previous versions"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data."}], "value": "Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2025-02-11T07:19:21.975Z"}, "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718"}, {"url": "https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds recommends customers upgrade to SolarWinds Kiwi Syslog NG 1.3.1 as soon as it becomes available. <p> </p>\n\n\n\n\n\n<br>"}], "value": "SolarWinds recommends customers upgrade to SolarWinds Kiwi Syslog NG 1.3.1 as soon as it becomes available."}], "source": {"discovery": "EXTERNAL"}, "title": "Sensitive data disclosure vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T15:12:11.743634Z", "id": "CVE-2024-45718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:12:15.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-11T15:12:11.743634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:11:59.632Z"}}], "cna": {"title": "Sensitive data disclosure vulnerability", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SolarWinds", "product": "Kiwi Syslog NG", "versions": [{"status": "affected", "version": "Kiwi 1.3 and previous versions"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "SolarWinds recommends customers upgrade to SolarWinds Kiwi Syslog NG 1.3.1 as soon as it becomes available.", "supportingMedia": [{"type": "text/html", "value": "SolarWinds recommends customers upgrade to SolarWinds Kiwi Syslog NG 1.3.1 as soon as it becomes available. <p> </p>\n\n\n\n\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718"}, {"url": "https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.", "supportingMedia": [{"type": "text/html", "value": "Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2025-02-11T07:19:21.975Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45718", "state": "PUBLISHED", "dateUpdated": "2025-02-11T15:12:15.783Z", "dateReserved": "2024-09-05T08:28:03.888Z", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "datePublished": "2025-02-11T07:19:21.975Z", "assignerShortName": "SolarWinds"}, "dataVersion": "5.1"}