PT-2024-2069 · Nginx+1 · Nginx+1

Bartvanb · Published 2024-01-30 · Updated 2024-02-08 · CVE-2024-22200

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions vantage6-UI versions prior to 4.2.0

Description The issue is related to insufficient protection of service data in the vantage6-UI interface, which can allow a remote attacker to gain unauthorized access to protected information. The docker image used to run the UI leaks the nginx version.

Recommendations For versions prior to 4.2.0, to mitigate the vulnerability, users can run the UI as an angular application. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-01963

CVE-2024-22200

GHSA-8WXQ-346H-XMR8

Affected Products

Nginx

Vantage6-Ui

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22200.json · Exploit
• https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-8wxq-346h-xmr8 · Vendor Advisory
• https://github.com/vantage6/vantage6-UI/commit/92e0fb5102b544d5bcc23980d973573733e2e020 · Patch
• https://osv.dev/vulnerability/CVE-2024-22200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22200 · Security Note
• https://bdu.fstec.ru/vul/2024-01963 · Security Note
• https://twitter.com/CVEnew/status/1752365686729453663 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752383248397725731 · Twitter Post