PT-2024-3306 · Kemp Technologies · Loadmaster

Published 2024-03-22 · Updated 2024-04-16 · CVE-2024-2449

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LoadMaster (affected versions not specified)

Description A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-03540

CVE-2024-2449

Affected Products

Loadmaster

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-2449 · Security Note
• https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03540 · Security Note
• https://twitter.com/RedPacketSec/status/1771479220822200540 · Twitter Post
• https://progress.com/loadmaster · Note
• https://t.me/secharvester/15967 · Telegram Post
• https://twitter.com/CVEnew/status/1771173144637657304 · Twitter Post
• https://t.me/cvenotify/74443 · Telegram Post