CVE-2024-9802

{"id": "CVE-2024-9802", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "zowe-security@lists.openmainframeproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-10T08:15:04.387", "references": [{"url": "https://github.com/zowe/api-layer", "source": "zowe-security@lists.openmainframeproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running."}, {"lang": "es", "value": "El endpoint de validaci\u00f3n de conformidad es p\u00fablico, por lo que todos pueden verificar la conformidad de los servicios incorporados. La respuesta podr\u00eda contener informaci\u00f3n espec\u00edfica sobre el servicio, incluidos los endpoints disponibles y swagger. Podr\u00eda informar a un atacante sobre la versi\u00f3n en ejecuci\u00f3n de un servicio. El atacante tambi\u00e9n podr\u00eda verificar si un servicio est\u00e1 en ejecuci\u00f3n."}], "lastModified": "2024-10-10T15:35:17.230", "sourceIdentifier": "zowe-security@lists.openmainframeproject.org"}