VulnerabilityModified

CVE-2024-38878

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions).

MEDIUM 6.9EPSS 11.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 11.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 11.45% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: siemens/omnivise t3000 application server
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-857368.htmlMitigation, Vendor Advisory
http://seclists.org/fulldisclosure/2024/Nov/5

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.