PT-2025-6663 · Atos · Atos Eviden Idra

Published 2025-02-18 · Updated 2025-02-18 · CVE-2024-39328

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atos Eviden IDRA and IDCA versions prior to 2.7.0

Description The issue concerns insecure permissions that could allow a highly trusted role, Config Admin, to exceed its configuration privileges in a multi-partition environment. This could lead to access to some confidential data. However, data integrity and availability are not at risk.

Recommendations For Atos Eviden IDRA and IDCA versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider restricting the privileges of the Config Admin role in multi-partition environments to minimize the risk of unauthorized access to confidential data.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-39328

Affected Products

Atos Eviden Idra

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-39328 · Security Note
• https://support.bull.com/ols/product/security/psirt/security-bulletins/potential-privilege-escalation-in-idpki-psirt-1335-tlp-clear-version-2-10-cve-2024-39327-cve-2024-39328-cve-2024-51505/view · Note
• https://eviden.com/solutions/digital-security/digital-identity · Note
• https://twitter.com/CVEnew/status/1891903249772576916 · Twitter Post