CVE-2024-45164

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html	Exploit Mitigation Third Party Advisory
https://www.akamai.com/global-services/support/vulnerability-reporting	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:akamai:secure_internet_access_enterprise_threatavert:19.2.0.2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-11-04 14:15

Updated : 2024-11-06 17:35

NVD link : CVE-2024-45164

Mitre link : CVE-2024-45164

CVE.ORG link : CVE-2024-45164

JSON object : View

Products Affected

akamai

secure_internet_access_enterprise_threatavert

CWE

CWE-863

Incorrect Authorization

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2024-45164", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-11-04T14:15:14.677", "references": [{"url": "https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.akamai.com/global-services/support/vulnerability-reporting", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement."}, {"lang": "es", "value": "Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, en SPS (Security and Personality Services) antes del \u00faltimo parche 19.2.0 y en Apps Portal antes de 19.2.0.3 o 19.2.0.20240814, tiene controles de autorizaci\u00f3n incorrectos para la funcionalidad de administrador en la p\u00e1gina de pol\u00edticas de ThreatAvert. Un usuario autenticado puede navegar directamente a la URL /#app/intelligence/threatAvertPolicies y deshabilitar la aplicaci\u00f3n de pol\u00edticas."}], "lastModified": "2024-11-06T17:35:33.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:akamai:secure_internet_access_enterprise_threatavert:19.2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBCD0583-5730-41B0-8F91-7E929A749F12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}