CVE-2024-8264: Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05
Published Oct 9, 2024
·Updated
Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled.
Affected Software
1 affected component
Fortra Robot Schedule>=1.24<3.05
Remediation
Information
Disable detailed logging for FTP and remove any sensitive log files. After upgrading to Robot Schedule Enterprise 3.05, detailed logging for FTP can be re-enabled as the username and password will no longer be written to the agent log.
Event History
Oct 9, 2024
CVE Published
via MITRE·10:44 PM
Data Sourced
via MITRE·10:44 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-8264?
CVE-2024-8264 is considered a moderate severity vulnerability due to the exposure of sensitive FTP credentials in log files.
2
How do I fix CVE-2024-8264?
To mitigate CVE-2024-8264, upgrade to Fortra Robot Schedule Enterprise Agent version 3.05 or later.
3
What impact does CVE-2024-8264 have on my system?
CVE-2024-8264 can potentially allow unauthorized access to systems if FTP credentials are exposed in the log files.
4
What versions of Fortra Robot Schedule are affected by CVE-2024-8264?
CVE-2024-8264 affects Fortra Robot Schedule Enterprise versions prior to 3.05.
5
Is detailed logging safe to use with CVE-2024-8264?
Using detailed logging with CVE-2024-8264 is not safe unless mitigations are in place to prevent sensitive information exposure.