PT-2024-16416 · Knightliao · Disconf

Gaogaostone + 1 · Published 2024-10-31 · Updated 2024-11-01 · CVE-2024-10620

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions knightliao Disconf version 2.6.36

Description A critical issue has been found, affecting an unknown part of the file /api/config/list of the component Configuration Center. This leads to improper authentication and can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 2.6.36, consider disabling access to the /api/config/list endpoint until a patch is available. Restrict access to the Configuration Center component to minimize the risk of exploitation. Avoid using this version until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-10620

Affected Products

Disconf

References · 11

• 🔥 https://github.com/knightliao/disconf/issues/431#issue-2607011340 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10620 · Security Note
• https://github.com/knightliao/disconf/issues/431 · Note
• https://vuldb.com/?id.282633 · Note
• https://vuldb.com/?submit.429927 · Note
• https://twitter.com/VulmonFeeds/status/1852321653365072330 · Twitter Post
• https://t.me/cvenotify/100256 · Telegram Post
• https://twitter.com/CVEnew/status/1852209733870195035 · Twitter Post
• https://vuldb.com/?ctiid.282633 · Note
• https://t.me/cvedetector/9564 · Telegram Post