CVE-2024-28022

A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true	Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true	Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true	Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hitachienergy:foxman-un:r15a:::::::*
	cpe:2.3:a:hitachienergy:foxman-un:r15b:::::::*
	cpe:2.3:a:hitachienergy:foxman-un:r16a:::::::*
	cpe:2.3:a:hitachienergy:foxman-un:r16b:::::::*
	cpe:2.3:a:hitachienergy:unem:r15a:::::::*
	cpe:2.3:a:hitachienergy:unem:r15b:::::::*
	cpe:2.3:a:hitachienergy:unem:r16a:::::::*
	cpe:2.3:a:hitachienergy:unem:r16b:::::::*

History

No history.

Information

Published : 2024-06-11 19:16

Updated : 2024-11-21 09:05

NVD link : CVE-2024-28022

Mitre link : CVE-2024-28022

CVE.ORG link : CVE-2024-28022

JSON object : View

Products Affected

hitachienergy

unem
foxman-un

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2024-28022", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.2}]}, "published": "2024-06-11T19:16:06.017", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true", "tags": ["Vendor Advisory"], "source": "cybersecurity@hitachienergy.com"}, {"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true", "tags": ["Vendor Advisory"], "source": "cybersecurity@hitachienergy.com"}, {"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of\nauthentication attempts using different passwords, and eventually\ngain access to other components in the same security realm using\nthe targeted account."}, {"lang": "es", "value": "Existe una vulnerabilidad en el servidor/APIGateway de FOXMAN-UN/UNEM que, si se explota, permite a un usuario malintencionado realizar un n\u00famero arbitrario de intentos de autenticaci\u00f3n utilizando diferentes contrase\u00f1as y, finalmente, obtener acceso a la cuenta objetivo."}], "lastModified": "2024-11-21T09:05:39.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7593C74-2882-45D3-AB32-3A45E3AECAAE"}, {"criteria": "cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47606044-296D-4561-B9DC-82659BC666F2"}, {"criteria": "cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EE987B2-0620-44BB-AEA7-4E20CBE44822"}, {"criteria": "cpe:2.3:a:hitachienergy:foxman-un:r16b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE743C56-A17F-4FA7-9998-0C767E07518A"}, {"criteria": "cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E78C9E5B-5876-4F15-A98A-359193287446"}, {"criteria": "cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3168F38-7B9E-4F4D-B6D0-1BAFB5FE05F5"}, {"criteria": "cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7ABB4A53-07A0-4F9A-824B-A1AC71CCB44E"}, {"criteria": "cpe:2.3:a:hitachienergy:unem:r16b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADA6755A-0553-4246-B462-7580B080FDEF"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@hitachienergy.com"}