ByteOS Network

Vulnerability Details :

CVE-2024-46505

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-09 Jan, 2025 | 00:00

Updated At-23 Jan, 2025 | 17:25

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:09 Jan, 2025 | 00:00

Updated At:23 Jan, 2025 | 17:25

▼CVE Numbering Authority (CNA)

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b	N/A

Hyperlink: https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-319	CWE-319 Cleartext Transmission of Sensitive Information
CWE	CWE-312	CWE-312 Cleartext Storage of Sensitive Information
CWE	CWE-798	CWE-798 Use of Hard-coded Credentials
CWE	CWE-276	CWE-276 Incorrect Default Permissions

Type: CWE

CWE ID: CWE-319

Description: CWE-319 Cleartext Transmission of Sensitive Information

Type: CWE

CWE ID: CWE-312

Description: CWE-312 Cleartext Storage of Sensitive Information

Type: CWE

CWE ID: CWE-798

Description: CWE-798 Use of Hard-coded Credentials

Type: CWE

CWE ID: CWE-276

Description: CWE-276 Incorrect Default Permissions

Metrics

Version	Base score	Base severity	Vector
3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:09 Jan, 2025 | 20:15

Updated At:23 Jan, 2025 | 18:15

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE ID	Type	Source
CWE-276	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-312	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-319	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-798	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-276

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-312

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-319

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-798

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b	cve@mitre.org	N/A

Hyperlink: https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b

Source: cve@mitre.org

Resource: N/A

Similar CVEs

6Records found

CVE-2021-31217

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.1||CRITICAL

EPSS-0.30% / 53.33%

7 Day CHG~0.00%

Published-13 Jul, 2021 | 17:57

Updated-03 Aug, 2024 | 22:55

In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.

Vendor-n/a SolarWinds Worldwide, LLC.

Product-dameware_mini_remote_control n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2024-10025

Matching Score-4

Assigner-SICK AG

View Details

Matching Score-4

Assigner-SICK AG

CVSS Score-9.1||CRITICAL

EPSS-0.11% / 29.91%

7 Day CHG-0.01%

Published-17 Oct, 2024 | 09:58

Updated-18 Oct, 2024 | 12:52

Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

Vendor-SICK AG

Product-SICK RFx6xx SICK CLV6xx SICK Lector6xx rfu620-10507_firmware

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2024-30415

Matching Score-4

Assigner-Huawei Technologies

View Details

Matching Score-4

Assigner-Huawei Technologies

CVSS Score-9.1||CRITICAL

EPSS-0.07% / 21.08%

7 Day CHG~0.00%

Published-07 Apr, 2024 | 08:06

Updated-13 Mar, 2025 | 14:51

Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.

Vendor-Huawei Technologies Co., Ltd.

Product-emui harmonyos HarmonyOS EMUI harmonyos emui

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2021-44140

Matching Score-4

Assigner-Apache Software Foundation

View Details

Matching Score-4

Assigner-Apache Software Foundation

CVSS Score-9.1||CRITICAL

EPSS-5.87% / 90.36%

7 Day CHG~0.00%

Published-24 Nov, 2021 | 11:15

Updated-04 Aug, 2024 | 04:17

Arbitrary file deletion on logout

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

Vendor-The Apache Software Foundation

Product-jspwiki Apache JSPWiki

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2021-40053

Matching Score-4

Assigner-Huawei Technologies

View Details

Matching Score-4

Assigner-Huawei Technologies

CVSS Score-9.1||CRITICAL

EPSS-0.15% / 36.23%

7 Day CHG~0.00%

Published-07 Mar, 2022 | 13:50

Updated-04 Aug, 2024 | 02:27

There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.

Vendor-n/a Huawei Technologies Co., Ltd.

Product-magic_ui emui harmonyos HarmonyOS;EMUI;Magic UI

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2024-57811

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.1||CRITICAL

EPSS-0.19% / 40.53%

7 Day CHG~0.00%

Published-13 Jan, 2025 | 00:00

Updated-16 Jan, 2025 | 18:15

In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the firmware. NOTE: This vulnerability appears in versions that are no longer supported by Eaton.

Vendor-n/a

Product-n/a

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2024-46505

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs