PT-2024-15915 · Microsoft · Windows+1

Published 2024-06-05 · Updated 2024-07-18 · CVE-2024-0912

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions C•CURE 9000 Web Server (affected versions not specified) Microsoft Internet Information Server (IIS) (affected versions not specified)

Description Under certain circumstances, the Microsoft Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces of C•CURE 9000 or prior versions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-0912

Affected Products

Internet Information Server

Windows

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-0912 · Security Note
• https://twitter.com/CveFindCom/status/1798505376595279943 · Twitter Post
• https://t.me/cvenotify/86670 · Telegram Post
• https://t.me/cvenotify/82130 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-135-03 · Note
• https://johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf · Note
• https://twitter.com/CVEnew/status/1798499950306934888 · Twitter Post