CVE-2024-24903

Katalog CVE

CVSS 8.0 · High EPSS 0,37%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada dell policy manager for secure connect gateway. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.

Rincian

Terbit di NVD

1 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gatewa... patch · advisory vendor