Lucene search

K
vulnrichmentRedhatVULNRICHMENT:CVE-2024-8509
HistorySep 06, 2024 - 3:17 p.m.

CVE-2024-8509 Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication

2024-09-0615:17:49
CWE-285
redhat
github.com
2
migration toolkit
virtualization
forklift-controller
authentication
vulnerability
cve-2024-8509

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0

Percentile

16.3%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

A vulnerability was found in Forklift Controller.  There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0

Percentile

16.3%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

Related for VULNRICHMENT:CVE-2024-8509