CVE-2024-9188 - Vulnerability Details - OpenCVE

Specially constructed queries cause cross platform scripting leaking administrator tokens

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00238.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Arista	Ng Firewall

Configuration 1 [-]

cpe:2.3:a:arista:ng_firewall:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-50437	Specially constructed queries cause cross platform scripting leaking administrator tokens

Fixes

Solution

The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience. * 17.2 Upgrade

Workaround

No known mitigation.

References

Link	Providers
https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105

History

Mon, 29 Sep 2025 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arista Arista ng Firewall
Weaknesses		CWE-79
CPEs		cpe:2.3:a:arista:ng_firewall::::::::
Vendors & Products		Arista Arista ng Firewall

Mon, 13 Jan 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 10 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Description		Specially constructed queries cause cross platform scripting leaking administrator tokens
Title		Specially constructed queries cause cross platform scripting leaking administrator tokens
References		https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Arista

Published: 2025-01-10T22:05:26.349Z

Updated: 2025-01-13T20:07:56.835Z

Reserved: 2024-09-25T20:35:08.729Z

Link: CVE-2024-9188

Vulnrichment

Updated: 2025-01-13T20:07:52.597Z

NVD

Status : Analyzed

Published: 2025-01-10T22:15:27.150

Modified: 2025-09-29T12:16:29.287

Link: CVE-2024-9188

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9188", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2024-09-25T20:35:08.729Z", "datePublished": "2025-01-10T22:05:26.349Z", "dateUpdated": "2025-01-13T20:07:56.835Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Arista Edge Threat Management", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "17.1.1", "status": "affected", "version": "17.1.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No required configuration.</span><br>"}], "value": "No required configuration."}], "credits": [{"lang": "en", "type": "finder", "value": "Gereon Huppertz"}], "datePublic": "2024-10-29T20:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Specially constructed queries cause cross platform scripting leaking administrator tokens</span><br>"}], "value": "Specially constructed queries cause cross platform scripting leaking administrator tokens"}], "impacts": [{"capecId": "CAPEC-39", "descriptions": [{"lang": "en", "value": "CAPEC-39 Manipulating Opaque Client-based Data Tokens"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "cwe-287", "lang": "en"}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-01-10T22:05:26.349Z"}, "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.</div><ul><li>17.2 Upgrade</li></ul>"}], "value": "The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.\n\n * 17.2 Upgrade"}], "source": {"advisory": "105", "defect": ["NGFW-14822"], "discovery": "EXTERNAL"}, "title": "Specially constructed queries cause cross platform scripting leaking administrator tokens", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No known mitigation.</span><br>"}], "value": "No known mitigation."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-13T20:07:44.936182Z", "id": "CVE-2024-9188", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-13T20:07:56.835Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9188", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-13T20:07:44.936182Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-13T20:07:52.597Z"}}], "cna": {"title": "Specially constructed queries cause cross platform scripting leaking administrator tokens", "source": {"defect": ["NGFW-14822"], "advisory": "105", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Gereon Huppertz"}], "impacts": [{"capecId": "CAPEC-39", "descriptions": [{"lang": "en", "value": "CAPEC-39 Manipulating Opaque Client-based Data Tokens"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "Arista Edge Threat Management", "versions": [{"status": "affected", "version": "17.1.0", "versionType": "custom", "lessThanOrEqual": "17.1.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.\n\n * 17.2 Upgrade", "supportingMedia": [{"type": "text/html", "value": "<div>The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.</div><ul><li>17.2 Upgrade</li></ul>", "base64": false}]}], "datePublic": "2024-10-29T20:20:00.000Z", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105"}], "workarounds": [{"lang": "en", "value": "No known mitigation.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No known mitigation.</span><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Specially constructed queries cause cross platform scripting leaking administrator tokens", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Specially constructed queries cause cross platform scripting leaking administrator tokens</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "cwe-287"}]}], "configurations": [{"lang": "en", "value": "No required configuration.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No required configuration.</span><br>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-01-10T22:05:26.349Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9188", "state": "PUBLISHED", "dateUpdated": "2025-01-13T20:07:56.835Z", "dateReserved": "2024-09-25T20:35:08.729Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2025-01-10T22:05:26.349Z", "assignerShortName": "Arista"}, "dataVersion": "5.1"}