CVE-2024-5828 - OpenCVE

Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hitachi	Tuning Manager

No data.

No data.

References

Link	Providers
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-140/index.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: Hitachi

Published: 2024-08-06T02:21:38.553Z

Updated: 2024-08-06T15:40:42.761Z

Reserved: 2024-06-11T01:34:48.734Z

Link: CVE-2024-5828

Vulnrichment

Updated: 2024-08-06T15:34:13.022Z

NVD

Status : Awaiting Analysis

Published: 2024-08-06T03:15:30.103

Modified: 2024-08-06T16:30:24.547

Link: CVE-2024-5828

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5828", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "state": "PUBLISHED", "assignerShortName": "Hitachi", "dateReserved": "2024-06-11T01:34:48.734Z", "datePublished": "2024-08-06T02:21:38.553Z", "dateUpdated": "2024-08-06T15:40:42.761Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux", "Solaris"], "product": "Hitachi Tuning Manager", "vendor": "Hitachi", "versions": [{"changes": [{"at": "8.8.7-00", "status": "unaffected"}], "lessThan": "8.8.7-00", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.<p>This issue affects Hitachi Tuning Manager: before 8.8.7-00.</p>"}], "value": "Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00."}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2024-08-06T02:21:38.553Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-140/index.html"}], "source": {"advisory": "hitachi-sec-2024-140", "discovery": "UNKNOWN"}, "title": "EL Injection Vulnerability in Hitachi Tuning Manager", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "hitachi", "product": "tuning_manager", "cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:windows:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "8.8.7-00", "versionType": "custom"}]}, {"vendor": "hitachi", "product": "tuning_manager", "cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:linux_kernel:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.8.7-00", "versionType": "custom"}]}, {"vendor": "hitachi", "product": "tuning_manager", "cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:solaris:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.8.7-00", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-06T15:32:14.077410Z", "id": "CVE-2024-5828", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T15:40:42.761Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-06T15:32:14.077410Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:windows:*:*"], "vendor": "hitachi", "product": "tuning_manager", "versions": [{"status": "affected", "version": "0", "lessThan": "8.8.7-00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:linux_kernel:*:*"], "vendor": "hitachi", "product": "tuning_manager", "versions": [{"status": "affected", "version": "0", "lessThan": "8.8.7-00", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:solaris:*:*"], "vendor": "hitachi", "product": "tuning_manager", "versions": [{"status": "affected", "version": "0", "lessThan": "8.8.7-00", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T15:34:13.022Z"}}], "cna": {"title": "EL Injection Vulnerability in Hitachi Tuning Manager", "source": {"advisory": "hitachi-sec-2024-140", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Tuning Manager", "versions": [{"status": "affected", "changes": [{"at": "8.8.7-00", "status": "unaffected"}], "version": "0", "lessThan": "8.8.7-00", "versionType": "custom"}], "platforms": ["Windows", "Linux", "Solaris"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-140/index.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.", "supportingMedia": [{"type": "text/html", "value": "Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.<p>This issue affects Hitachi Tuning Manager: before 8.8.7-00.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2024-08-06T02:21:38.553Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5828", "state": "PUBLISHED", "dateUpdated": "2024-08-06T15:40:42.761Z", "dateReserved": "2024-06-11T01:34:48.734Z", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "datePublished": "2024-08-06T02:21:38.553Z", "assignerShortName": "Hitachi"}, "dataVersion": "5.1"}