PT-2024-22217 · Unknown · Unem Server+1

Published 2024-06-11 · Updated 2025-02-09 · CVE-2024-28022

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions UNEM server / APIGateway (affected versions not specified) FOXMAN-UN/UNEM server / APIGateway (affected versions not specified)

Description A vulnerability exists in the UNEM server / APIGateway that allows a malicious user to perform an arbitrary number of authentication attempts using different passwords. This could eventually grant access to other components in the same security realm or the targeted account. The issue is being actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-28022

Affected Products

Apigateway

Unem Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-28022 · Security Note
• https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true · Vendor Advisory
• https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28022 · Vendor Advisory
• https://twitter.com/transilienceai/status/1888561577562882053 · Twitter Post
• https://t.me/cvenotify/82901 · Telegram Post
• https://twitter.com/transilienceai/status/1887486139369480206 · Twitter Post
• https://t.me/cvenotify/90848 · Telegram Post