PT-2024-29528 · Adacore · Ada Web Services

Published 2024-09-25 · Updated 2024-09-26 · CVE-2024-41708

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AdaCore ada web services version 20.0

Description An issue was discovered that allows an attacker to escalate privileges and steal sessions via the Random String() function in the src/core/aws-utils.adb module. This issue affects AdaCore ada web services, enabling attackers to exploit the Random String() function for malicious purposes.

Recommendations For AdaCore ada web services version 20.0, consider disabling the Random String() function in the src/core/aws-utils.adb module as a temporary workaround until a patch is available. Restrict access to the src/core/aws-utils.adb module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2024-41708

Affected Products

Ada Web Services

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-41708 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41708 · Vendor Advisory
• https://github.com/AdaCore/aws · Note
• https://twitter.com/CVEnew/status/1838983861407015293 · Twitter Post
• https://docs.adacore.com/corp/security-advisories/SEC.AWS-0040-v2.pdf · Note
• https://twitter.com/VulmonFeeds/status/1839024631300215215 · Twitter Post
• https://t.me/cvedetector/6339 · Telegram Post