PT-2024-37893 · Unknown · Apiml Spring Cloud Gateway

Andrej Chmelo + 1 · Published 2024-07-17 · Updated 2024-08-01 · CVE-2024-6834

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions APIML Spring Cloud Gateway (affected versions not specified)

Description A vulnerability in APIML Spring Cloud Gateway allows unauthorized access to endpoints that require an internal client certificate. This occurs because the gateway unexpectedly signs proxied requests with Zowe's client certificate, leveraging user privileges. As a result, an attacker can access and manage components, potentially handling the entire communication, including user credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2024-6834

Affected Products

Apiml Spring Cloud Gateway

References · 4

• https://osv.dev/vulnerability/CVE-2024-6834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6834 · Security Note
• https://github.com/zowe/api-layer · Note
• https://t.me/cvedetector/1080 · Telegram Post