CVE-2024-31844

An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside an error message, some information about the server is revealed, such as the absolute path of the source code of the application. This kind of information can help an attacker to perform other attacks against the system. This can be exploited without authentication.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.gruppotim.it/it/footer/red-team.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:italtel:embrace:1.6.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-05-21 16:15

Updated : 2024-07-26 18:21

NVD link : CVE-2024-31844

Mitre link : CVE-2024-31844

CVE.ORG link : CVE-2024-31844

JSON object : View

Products Affected

italtel

embrace

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2024-31844", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-05-21T16:15:26.027", "references": [{"url": "https://www.gruppotim.it/it/footer/red-team.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside an error message, some information about the server is revealed, such as the absolute path of the source code of the application. This kind of information can help an attacker to perform other attacks against the system. This can be exploited without authentication."}, {"lang": "es", "value": " Se descubri\u00f3 un problema en Italtel Embrace 1.6.4. El servidor no maneja adecuadamente los errores de la aplicaci\u00f3n. En algunos casos, esto conduce a la divulgaci\u00f3n de informaci\u00f3n sobre el servidor. Un usuario no autenticado puede crear solicitudes espec\u00edficas para que la aplicaci\u00f3n genere un error. Dentro de un mensaje de error se revela cierta informaci\u00f3n sobre el servidor, como la ruta absoluta del c\u00f3digo fuente de la aplicaci\u00f3n. Este tipo de informaci\u00f3n puede ayudar a un atacante a realizar otros ataques contra el sistema. Esto se puede explotar sin autenticaci\u00f3n."}], "lastModified": "2024-07-26T18:21:23.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:italtel:embrace:1.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3469B5CE-AB48-497A-94DF-820F97DB88B3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}