SB2024101660 - Multiple vulnerabilities in Rockwell Automation DataMosaix Private Cloud

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024101660

SB2024101660 - Multiple vulnerabilities in Rockwell Automation DataMosaix Private Cloud

Published: October 16, 2024

Security Bulletin ID SB2024101660
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2024-7952)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the hardcoded links in the source code that lead to JSON files that can be reached without authentication. A remote attacker can gain unauthorized access to sensitive information on the system.


2) Missing Authorization (CVE-ID: CVE-2024-7953)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization controls in Azure Stack Hyperconverged Infrastructure (HCI). A remote user can create a project and become the administrator for it.


3) Incorrect authorization (CVE-ID: CVE-2024-7956)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to broken access control in several PATCH endpoints. A remote user can gain access to user's projects to modify and delete the project.


Remediation

Install update from vendor's website.

References