CVE-2024-9802
Conformance validation endpoint discloses detail about service to unauthenticated users
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 10, 2024
- Updated
- Oct 10, 2024
- Reserved
- Oct 10, 2024
Description
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C | Zowe |
Weaknesses
- CWE-312 Cleartext Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
ZoweOpen Mainframe Project |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.