CVE-2024-9802

EUVD-2024-50125
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ZoweCNA
5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
linuxfoundationzowe_api_mediation_layer
2.17.0 <
𝑥
< 2.17.0
linuxfoundationzowe_api_mediation_layer
2.11.0 ≤
𝑥
< 2.17.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/zowe/api-layer