CVE-2024-3543

Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kemptechnologies.com/	Product
https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543	Product
https://kemptechnologies.com/	Product
https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:loadmaster:::::ltsf:::*
	cpe:2.3:a:progress:loadmaster:::::ga:::*
	cpe:2.3:a:progress:loadmaster:7.2.48.11::::lts:::

History

10 Feb 2025, 15:16

Type	Values Removed	Values Added
References	~~() https://kemptechnologies.com/ -~~	() https://kemptechnologies.com/ - Product
References	~~() https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543 -~~	() https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543 - Product
CPE		cpe:2.3:a:progress:loadmaster:::::ltsf:::* cpe:2.3:a:progress:loadmaster:7.2.48.11::::lts::: cpe:2.3:a:progress:loadmaster:::::ga:::*
First Time		Progress Progress loadmaster
CWE		CWE-522

Information

Published : 2024-05-02 14:15

Updated : 2025-02-10 15:16

NVD link : CVE-2024-3543

Mitre link : CVE-2024-3543

CVE.ORG link : CVE-2024-3543

JSON object : View

Products Affected

progress

loadmaster

CWE

CWE-257

Storing Passwords in a Recoverable Format

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2024-3543", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-05-02T14:15:10.573", "references": [{"url": "https://kemptechnologies.com/", "tags": ["Product"], "source": "security@progress.com"}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543", "tags": ["Product"], "source": "security@progress.com"}, {"url": "https://kemptechnologies.com/", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-257"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "\nUse of reversible password encryption algorithm allows attackers to decrypt passwords.\u00a0 Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.\n\n"}, {"lang": "es", "value": "El uso de un algoritmo de cifrado de contrase\u00f1a reversible permite a los atacantes descifrar contrase\u00f1as. El atacante puede descifrar f\u00e1cilmente la informaci\u00f3n confidencial y las credenciales robadas pueden usarse para acciones arbitrarias que corrompan el sistema."}], "lastModified": "2025-02-10T15:16:45.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*", "vulnerable": true, "matchCriteriaId": "71C25CAF-73A9-4F9A-9914-ABCFB0C9D4BE", "versionEndExcluding": "7.2.54.10", "versionStartIncluding": "7.2.49.0"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*", "vulnerable": true, "matchCriteriaId": "651AEE76-E95B-4E43-86E6-190062B23FE7", "versionEndExcluding": "7.2.59.4", "versionStartIncluding": "7.2.55.0"}, {"criteria": "cpe:2.3:a:progress:loadmaster:7.2.48.11:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC71B68-F870-4ECF-9655-6E64C7546C96"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}