PT-2024-15527 · Unknown · Scm Server

Published 2024-03-26 · Updated 2024-03-28 · CVE-2024-0400

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SCM Software (affected versions not specified)

Description The issue allows an authenticated malicious client to send specially crafted code to skip validation and execute arbitrary code remotely on the SCM Server. This can be achieved by exploiting the ability of authenticated system manager clients to execute LINQ queries in the SCM server for customized filtering. The malicious client can execute any command using this exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-0400

Affected Products

Scm Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-0400 · Security Note
• https://twitter.com/CVEnew/status/1772815174518686054 · Twitter Post
• https://twitter.com/cracbot/status/1773552796714823820 · Twitter Post
• https://publisher.hitachienergy.com/preview?DocumentId=8DBD000189&languageCode=en&Preview=true · Note