Details of VAR-202410-1985

ID

VAR-202410-1985

CVE

CVE-2024-47240

TITLE

Dell's secure connect gateway Vulnerability regarding improper default permissions in

Trust: 0.8

sources: JVNDB: JVNDB-2024-011285

DESCRIPTION

Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system and could potentially exploit this vulnerability to gain write access to unauthorized data and cause a version update failure condition. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-47240 // JVNDB: JVNDB-2024-011285

AFFECTED PRODUCTS

vendor:	dell	model:	secure connect gateway	scope:	eq	version:	5.24.00.14	Trust: 1.0
vendor:	デル	model:	secure connect gateway	scope:	eq	version:	-	Trust: 0.8
vendor:	デル	model:	secure connect gateway	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	secure connect gateway	scope:	eq	version:	5.24.00.14	Trust: 0.8

sources: JVNDB: JVNDB-2024-011285 // NVD: CVE-2024-47240

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2024-47240
value:	MEDIUM
Trust: 1.0
security_alert@emc.com:	CVE-2024-47240
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2024-47240
value:	MEDIUM
Trust: 0.8

nvd@nist.gov:	CVE-2024-47240
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
security_alert@emc.com:	CVE-2024-47240
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.1
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2024-47240
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-011285 // NVD: CVE-2024-47240 // NVD: CVE-2024-47240

PROBLEMTYPE DATA

problemtype:	CWE-276	Trust: 1.0
problemtype:	Inappropriate default permissions (CWE-276) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-011285 // NVD: CVE-2024-47240

EXTERNAL IDS

db:	NVD	id:	CVE-2024-47240	Trust: 2.6
db:	JVNDB	id:	JVNDB-2024-011285	Trust: 0.8

sources: JVNDB: JVNDB-2024-011285 // NVD: CVE-2024-47240

REFERENCES

url:	https://www.dell.com/support/kbdoc/en-us/000237211/dsa-2024-407-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-47240	Trust: 0.8

sources: JVNDB: JVNDB-2024-011285 // NVD: CVE-2024-47240

SOURCES

db:	JVNDB	id:	JVNDB-2024-011285
db:	NVD	id:	CVE-2024-47240

LAST UPDATE DATE

2024-10-30T23:31:46.989000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-011285	date:	2024-10-28T08:05:00
db:	NVD	id:	CVE-2024-47240	date:	2024-10-22T15:28:55.637

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-011285	date:	2024-10-28T00:00:00
db:	NVD	id:	CVE-2024-47240	date:	2024-10-18T12:15:02.773