CVE-2024-9129 - OpenCVE

In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Zend	Zend Server

No data.

No data.

References

Link	Providers
https://portal.perforce.com/s/detail/a91PA000001SYZFYA4

History

Tue, 22 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zend Zend zend Server
CPEs		cpe:2.3:a:zend:zend_server::::::::
Vendors & Products		Zend Zend zend Server
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 22 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
Description		In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino
Title		Format String Injection in Zend Server
Weaknesses		CWE-134
References		https://portal.perforce.com/s/detail/a91PA000001SYZFYA4
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2024-10-22T17:09:04.384Z

Updated: 2024-10-22T17:56:22.159Z

Reserved: 2024-09-23T21:57:10.547Z

Link: CVE-2024-9129

Vulnrichment

Updated: 2024-10-22T17:56:16.750Z

NVD

Status : Awaiting Analysis

Published: 2024-10-22T17:15:06.557

Modified: 2024-10-23T15:12:34.673

Link: CVE-2024-9129

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9129", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2024-09-23T21:57:10.547Z", "datePublished": "2024-10-22T17:09:04.384Z", "dateUpdated": "2024-10-22T17:56:22.159Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Zend Server", "vendor": "Zend", "versions": [{"lessThan": "9.1", "status": "affected", "version": "8.5", "versionType": "sem"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In versions of Zend Server</span><span style=\"background-color: rgb(255, 255, 255);\"> 8.5 and prior to</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\"> 9.</span><span style=\"background-color: rgb(255, 255, 255);\">2</span><span style=\"background-color: rgb(255, 255, 255);\"> a format string injection was discovered. </span><br><br>Reported by Dylan Marino<br>"}], "value": "In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. \n\nReported by Dylan Marino"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-134", "description": "CWE-134", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2024-10-22T17:26:05.410Z"}, "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SYZFYA4"}], "source": {"discovery": "UNKNOWN"}, "title": "Format String Injection in Zend Server", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "zend", "product": "zend_server", "cpes": ["cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.5", "status": "affected", "lessThan": "9.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T17:55:29.926971Z", "id": "CVE-2024-9129", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T17:56:22.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-22T17:55:29.926971Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:*"], "vendor": "zend", "product": "zend_server", "versions": [{"status": "affected", "version": "8.5", "lessThan": "9.1", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T17:56:16.750Z"}}], "cna": {"title": "Format String Injection in Zend Server", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zend", "product": "Zend Server", "versions": [{"status": "affected", "version": "8.5", "lessThan": "9.1", "versionType": "sem"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SYZFYA4"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. \n\nReported by Dylan Marino", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In versions of Zend Server</span><span style=\"background-color: rgb(255, 255, 255);\"> 8.5 and prior to</span><span style=\"background-color: rgb(255, 255, 255);\"> version</span><span style=\"background-color: rgb(255, 255, 255);\"> 9.</span><span style=\"background-color: rgb(255, 255, 255);\">2</span><span style=\"background-color: rgb(255, 255, 255);\"> a format string injection was discovered. </span><br><br>Reported by Dylan Marino<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "CWE-134"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2024-10-22T17:26:05.410Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9129", "state": "PUBLISHED", "dateUpdated": "2024-10-22T17:56:22.159Z", "dateReserved": "2024-09-23T21:57:10.547Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2024-10-22T17:09:04.384Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. \n\nReported by Dylan Marino"}, {"lang": "es", "value": " En las versiones de Zend Server 8.5 y anteriores a la versi\u00f3n 9.2 se detect\u00f3 una inyecci\u00f3n de cadena de formato. Reportado por Dylan Marino"}], "id": "CVE-2024-9129", "lastModified": "2024-10-23T15:12:34.673", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "security@puppet.com", "type": "Secondary"}]}, "published": "2024-10-22T17:15:06.557", "references": [{"source": "security@puppet.com", "url": "https://portal.perforce.com/s/detail/a91PA000001SYZFYA4"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "security@puppet.com", "type": "Secondary"}]}