CVE-2024-9802: Conformance validation endpoint discloses detail about service to unauthenticated users
First published: Thu Oct 10 2024(Updated: )
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
Credit: zowe-security@lists.openmainframeproject.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Zowe Api Mediation Layer | >=2.11.0<2.17.0 |
Remedy
There is a fix since version 2.17.0, authentication is required for the endpoints.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/remedy
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/epss
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/event
- agent/trending
- vendor/linuxfoundation
- canonical/linuxfoundation zowe api mediation layer
- version/linuxfoundation zowe api mediation layer/2.11.0