PT-2024-39847 · Open Mainframe+2 · Zowe+3

Pavel Jareš · Published 2024-10-10 · Updated 2024-12-19 · CVE-2024-9802

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The conformance validation endpoint is publicly accessible, allowing anyone to verify the conformance of onboarded services. The response from this endpoint may contain specific information about the service, including available endpoints and swagger details. This could potentially advise an attacker about the running version of a service and whether a service is currently running.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2024-9802

Affected Products

Zowe

Api-Layer

Api Mediation Layer

Zowe Api Mediation Layer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-9802 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9802 · Vendor Advisory
• https://github.com/zowe/api-layer · Note
• https://t.me/cvenotify/104909 · Telegram Post
• https://t.me/cvenotify/102519 · Telegram Post
• https://twitter.com/CVEnew/status/1844284668142575859 · Twitter Post
• https://t.me/cvenotify/97727 · Telegram Post
• https://t.me/cvedetector/7570 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1844459369842274464 · Twitter Post