PT-2024-38899 · Fortra · Robot Schedule Enterprise Agent

Published 2024-10-09 · Updated 2024-10-17 · CVE-2024-8264

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Fortra's Robot Schedule Enterprise Agent versions prior to 3.05

Description: The issue concerns the writing of FTP username and password information to the agent log file when detailed logging is enabled. This affects the security of the system by potentially exposing sensitive credentials.

Recommendations: For versions prior to 3.05, update to version 3.05 or later to resolve the issue. As a temporary workaround, consider disabling detailed logging until the update is applied. Restrict access to the agent log file to minimize the risk of credential exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-8264

Affected Products

Robot Schedule Enterprise Agent

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-8264 · Security Note
• https://fortra.com/security/advisories/product-security/fi-2024-012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8264 · Vendor Advisory
• https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm · Note
• https://twitter.com/CVEnew/status/1844148735061917880 · Twitter Post
• https://t.me/cvedetector/7536 · Telegram Post