PT-2025-6663 · Atos · Atos Eviden Idra

Publicado 2025-02-18 · Atualizado 2025-02-18 · CVE-2024-39328

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atos Eviden IDRA and IDCA versions prior to 2.7.0

Description The issue concerns insecure permissions that could allow a highly trusted role, Config Admin, to exceed its configuration privileges in a multi-partition environment. This could lead to access to some confidential data. However, data integrity and availability are not at risk.

Recommendations For Atos Eviden IDRA and IDCA versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider restricting the privileges of the Config Admin role in multi-partition environments to minimize the risk of unauthorized access to confidential data.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2024-39328

Produtos afetados

Atos Eviden Idra

Referências · 4

• https://support.bull.com/ols/product/security/psirt/security-bulletins/potential-privilege-escalation-in-idpki-psirt-1335-tlp-clear-version-2-10-cve-2024-39327-cve-2024-39328-cve-2024-51505/view · Nota
• https://eviden.com/solutions/digital-security/digital-identity · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-39328 · Nota de Segurança
• https://twitter.com/CVEnew/status/1891903249772576916 · Publicação no Twitter