CVE-2024-7265

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7265
Incorrect User Management vulnerability in Naukowa i Akademicka Sie? Komputerowa - Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert.pl/en/posts/2024/08/CVE-2023-7265/ Broken Link
https://cert.pl/posts/2024/08/CVE-2023-7265/ Broken Link
https://www.gov.pl/web/ezd-rp Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nask:ezd_rp:*:*:*:*:*:*:*:*
cpe:2.3:a:nask:ezd_rp:*:*:*:*:*:*:*:*
cpe:2.3:a:nask:ezd_rp:*:*:*:*:*:*:*:*
History

23 Aug 2024, 15:09

Type Values Removed Values Added
CPE cpe:2.3:a:nask:ezd_rp:*:*:*:*:*:*:*:*
References () https://cert.pl/en/posts/2024/08/CVE-2023-7265/ - () https://cert.pl/en/posts/2024/08/CVE-2023-7265/ - Broken Link
References () https://cert.pl/posts/2024/08/CVE-2023-7265/ - () https://cert.pl/posts/2024/08/CVE-2023-7265/ - Broken Link
References () https://www.gov.pl/web/ezd-rp - () https://www.gov.pl/web/ezd-rp - Product
Summary (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2. (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sie? Komputerowa - Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-863
First Time Nask ezd Rp
Nask

08 Aug 2024, 15:15

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de administración incorrecta de usuarios en Naukowa i Akademicka Sie? Komputerowa - Pa?stwowy Instytut Badawczy EZD RP permite que un usuario conectado cambie la contraseña de cualquier usuario, incluido el usuario root, lo que podría provocar una escalada de privilegios. Este problema afecta a EZD RP: desde la versión 15 hasta la 15.84, desde la versión 16 hasta la 16.15, desde la versión 17 hasta la 17.2.
Summary (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sie? Komputerowa - Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2. (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.

07 Aug 2024, 15:17

Type Values Removed Values Added
Summary (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2. (en) Incorrect User Management vulnerability in Naukowa i Akademicka Sie? Komputerowa - Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.

07 Aug 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-07 11:15

Updated : 2024-08-23 15:09

NVD link : CVE-2024-7265

Mitre link : CVE-2024-7265

CVE.ORG link : CVE-2024-7265

JSON object : View

Products Affected

nask

  • ezd_rp
CWE
CWE-863

Incorrect Authorization

CWE-286

Incorrect User Management