CVE-2024-8264

Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm	Release Notes
https://www.fortra.com/security/advisories/product-security/fi-2024-012	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortra:robot_schedule:*:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2024-10-09 23:15

Updated : 2024-10-17 14:06

NVD link : CVE-2024-8264

Mitre link : CVE-2024-8264

CVE.ORG link : CVE-2024-8264

JSON object : View

Products Affected

fortra

robot_schedule

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2024-8264", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-10-09T23:15:11.093", "references": [{"url": "https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm", "tags": ["Release Notes"], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}, {"url": "https://www.fortra.com/security/advisories/product-security/fi-2024-012", "tags": ["Vendor Advisory"], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled."}, {"lang": "es", "value": "Fortra's Robot Schedule Enterprise Agent anterior a la versi\u00f3n 3.05 escribe la informaci\u00f3n de nombre de usuario y contrase\u00f1a de FTP en el archivo de registro del agente cuando est\u00e1 habilitado el registro detallado."}], "lastModified": "2024-10-17T14:06:39.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortra:robot_schedule:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "44ADDC12-9EA8-4BA4-9D76-57FC4A558367", "versionEndExcluding": "3.05", "versionStartIncluding": "1.24"}], "operator": "OR"}]}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}