PT-2024-30938 · Microcks · Microcks

Lbroudoux · Published 2024-08-18 · Updated 2024-08-23 · CVE-2024-44076

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microcks versions prior to 1.10.0

Description The issue allows non-administrator access to the "POST /api/import" and "POST /api/export" endpoints.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "POST /api/import" and "POST /api/export" endpoints to minimize the risk of exploitation.

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2024-44076

GHSA-R6PH-5FP2-3W2V

Affected Products

Microcks

References · 17

• https://github.com/microcks/microcks/issues/1212 · Vendor Advisory
• https://github.com/microcks/microcks/compare/1.9.1-fix-1...1.10.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-44076 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44076 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6ph-5fp2-3w2v · Vendor Advisory
• https://github.com/microcks/microcks · Note
• https://github.com/microcks/microcks/releases/tag/1.10.0 · Note
• https://github.com/microcks/microcks/commit/4bb98d76f050710e42f5978877fe70e2f6edabf0 · Note
• https://github.com/microcks/microcks/commit/a47d105eb45dac5a0712d6e6bf12b3a4347e5e68 · Note
• https://twitter.com/cracbot/status/1827224377580253296 · Twitter Post
• https://twitter.com/CveFindCom/status/1826982859208261705 · Twitter Post
• https://twitter.com/cracbot/status/1826862036795486578 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1825405356832350229 · Twitter Post
• https://t.me/cvenotify/91091 · Telegram Post
• https://twitter.com/CVEnew/status/1825375257970328015 · Twitter Post