nvd.nist.gov
Open in
urlscan Pro
2600:1f18:268d:1d01:f609:5e91:8a48:f546
Public Scan
Submitted URL: https://click.email.sans.org/?qs=9f241915c68df8fa0cd4616496fbe92320deb9fdef3677644e951fece976c9d9f29db3320393b6711a7cdab6028c...
Effective URL: https://nvd.nist.gov/vuln/detail/CVE-2024-45493?is=3d44c04a78dedd819b4246d3919905c9409e1693a8ebfe42e634edae7e2c018b
Submission: On December 23 via api from AE — Scanned from ES
Effective URL: https://nvd.nist.gov/vuln/detail/CVE-2024-45493?is=3d44c04a78dedd819b4246d3919905c9409e1693a8ebfe42e634edae7e2c018b
Submission: On December 23 via api from AE — Scanned from ES
Form analysis
0 forms found in the DOMText Content
YOU ARE VIEWING THIS PAGE IN AN UNAUTHORIZED FRAME WINDOW. This is a potential security issue, you are being redirected to https://nvd.nist.gov You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality. An official website of the United States government Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. NVD MENU * General Expand or Collapse NVD Dashboard News and Status Updates FAQ Visualizations Legal Disclaimer * Vulnerabilities Expand or Collapse Search & Statistics Weakness Types Legacy Data Feeds Vendor Comments CVMAP * Vulnerability Metrics Expand or Collapse CVSS v4.0 Calculators CVSS v3.x Calculators CVSS v2.0 Calculator * Products Expand or Collapse CPE Dictionary CPE Search CPE Statistics SWID * Developers Expand or Collapse Start Here Request an API Key Vulnerabilities Products Data Sources Terms of Use * Contact NVD * Other Sites Expand or Collapse Checklist (NCP) Repository Configurations (CCE) 800-53 Controls SCAP Validated Tools SCAP USGCB * Search Expand or Collapse Vulnerability Search CPE Search INFORMATION TECHNOLOGY LABORATORY NATIONAL VULNERABILITY DATABASE NATIONAL VULNERABILITY DATABASE NVD 1. Vulnerabilities CVE-2024-45493 DETAIL Awaiting Analysis -------------------------------------------------------------------------------- This vulnerability is currently awaiting analysis. DESCRIPTION An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password). METRICS CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings: NIST: NVD N/A NVD assessment not yet provided. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. ADP: CISA-ADP Base Score: 9.8 CRITICAL Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS 2.0 Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. REFERENCES TO ADVISORIES, SOLUTIONS, AND TOOLS By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. Hyperlink Resource https://us.msasafety.com/fieldserver https://us.msasafety.com/security-notices WEAKNESS ENUMERATION CWE-ID CWE Name Source CWE-862 Missing Authorization CISA-ADP CHANGE HISTORY 4 change records found show changes CVE MODIFIED BY MITRE 12/17/2024 2:15:06 PM Action Type Old Value New Value Changed Description An issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build revisions before 7.0.0. The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password). An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password). CVE MODIFIED BY MITRE 12/13/2024 12:15:06 PM Action Type Old Value New Value Added Reference https://us.msasafety.com/security-notices Removed Reference https://us.msasafety.com/security-notices: CVE MODIFIED BY CISA-ADP 12/11/2024 11:15:11 AM Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-862 NEW CVE RECEIVED FROM MITRE 12/10/2024 12:15:10 PM Action Type Old Value New Value Added Description An issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build revisions before 7.0.0. The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password). Added Reference https://us.msasafety.com/fieldserver Added Reference https://us.msasafety.com/security-notices: QUICK INFO CVE Dictionary Entry: CVE-2024-45493 NVD Published Date: 12/10/2024 NVD Last Modified: 12/17/2024 Source: MITRE * twitter (link is external) * facebook (link is external) * linkedin (link is external) * youtube (link is external) * rss * govdelivery (link is external) HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 (301) 975-2000 Webmaster | Contact Us | Our Other Offices Incident Response Assistance and Non-NVD Related Technical Cyber Security Questions: US-CERT Security Operations Center Email: soc@us-cert.gov Phone: 1-888-282-0870 Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov