CVE-2024-48730

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48730
The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts performed by the default admin user, allowing a remote attacker to escalate privileges.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.osmium.solutions/articles/osm-mano-vulnerability-discovery.html#2
Configurations

No configuration.

History

18 Aug 2025, 20:15

Type Values Removed Values Added
Summary (en) An issue in ETSI Open-Source MANO (OSM) v.14.x, v.15.x allows a remote attacker to escalate privileges via not imposing any restrictions on the authentication attempts performed by an admin user (en) The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts performed by the default admin user, allowing a remote attacker to escalate privileges.

18 Aug 2025, 13:15

Type Values Removed Values Added
References
  • {'url': 'http://etsi.com', 'source': 'cve@mitre.org'}
  • {'url': 'http://open.com', 'source': 'cve@mitre.org'}
Summary
  • (es) Un problema en ETSI Open-Source MANO (OSM) v.14.x, v.15.x permite que un atacante remoto escale privilegios al no imponer ninguna restricción en los intentos de autenticación realizados por un usuario administrador.

25 Jul 2025, 21:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-269

25 Jul 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 15:15

Updated : 2025-08-18 20:15

NVD link : CVE-2024-48730

Mitre link : CVE-2024-48730

CVE.ORG link : CVE-2024-48730

JSON object : View

Products Affected

No product.

CWE
CWE-269

Improper Privilege Management