PT-2024-6298 · Unknown · Forklift Controller

Andrew Block · Published 2024-09-06 · Updated 2024-09-09 · CVE-2024-8509

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forklift Controller (affected versions not specified)

Description A vulnerability was found in Forklift Controller due to insufficient authorization procedure. The issue arises because there is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information. This could allow a remote attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2024-07247

CVE-2024-8509

Affected Products

Forklift Controller

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-8509 · Security Note
• https://bdu.fstec.ru/vul/2024-07247 · Security Note
• https://access.redhat.com/errata/RHSA-2024:6487 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2310406 · Note
• https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.5/html-single/installing_and_using_the_migration_toolkit_for_virtualization/index#installing-mtv-operator_web · Note
• https://twitter.com/VulmonFeeds/status/1832146206107025735 · Twitter Post
• https://t.me/cvedetector/4976 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2024-8509 · Note
• https://vuldb.com/?id.276732 · Note
• https://t.me/cvenotify/93876 · Telegram Post
• https://twitter.com/CVEnew/status/1832079508054126880 · Twitter Post