PT-2024-27346 · Zsa · Zsa

Published 2024-06-06 · Updated 2024-10-31 · CVE-2024-37162

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions zsa versions prior to 0.3.3

Description The zsa application transfers the parse error stack from the server to the client in production build mode, potentially revealing sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this to gain unauthorized access to sensitive server information, which could be used to plan further attacks or gain a deeper understanding of the server infrastructure. All users are impacted.

Recommendations For versions prior to 0.3.3, update to version 0.3.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive server information until the update is applied.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2024-37162

GHSA-WJMJ-H3XC-HXP8

Affected Products

Zsa

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37162.json · Exploit
• https://github.com/IdoPesok/zsa/security/advisories/GHSA-wjmj-h3xc-hxp8 · Vendor Advisory
• https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3a · Patch
• https://osv.dev/vulnerability/CVE-2024-37162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37162 · Security Note
• https://osv.dev/vulnerability/GHSA-wjmj-h3xc-hxp8 · Vendor Advisory
• https://github.com/IdoPesok/zsa · Note
• https://twitter.com/VulmonFeeds/status/1799119892483850339 · Twitter Post
• https://t.me/cvenotify/82318 · Telegram Post