10

CVE-2024-1212

Warnung

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Progress ≫ Loadmaster Version >= 7.2.48.1 < 7.2.48.10
Progress ≫ Loadmaster Version >= 7.2.54.0 < 7.2.54.8
Progress ≫ Loadmaster Version >= 7.2.55.0 < 7.2.59.2

18.11.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Progress Kemp LoadMaster OS Command Injection Vulnerability

Schwachstelle

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 94.36% 1
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@progress.com 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.