Lucene search

GoogleOSV:GHSA-QV6X-53JJ-VW59

HistoryMay 21, 2024 - 9:30 p.m.

NASA AIT-Core uses unencrypted channels to exchange data over the network

2024-05-2121:30:27

Google

osv.dev

nasa

ait-core

unencrypted

data exchange

network security

man-in-the-middle

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.5 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack.

CPENameOperatorVersion
ait-coreeq1.3.0
ait-coreeq2.3.1
ait-coreeq2.3.5
ait-coreeq1.1.0
ait-coreeq2.5.0
ait-coreeq1.0.0
ait-coreeq2.0.0
ait-coreeq2.1.0
ait-coreeq2.0rc1.dev0
ait-coreeq2.2.0

Name	Operator	Version
ait-core	eq	1.3.0
ait-core	eq	2.3.1
ait-core	eq	2.3.5
ait-core	eq	1.1.0
ait-core	eq	2.5.0
ait-core	eq	1.0.0
ait-core	eq	2.0.0
ait-core	eq	2.1.0
ait-core	eq	2.0rc1.dev0
ait-core	eq	2.2.0

Rows per page:

1-10 of 201

References

github.com/NASA-AMMOS/AIT-Core

nvd.nist.gov/vuln/detail/CVE-2024-35061

www.linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.5 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Related for OSV:GHSA-QV6X-53JJ-VW59