2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"wolfSSH","repo":"https://github.com/wolfSSL/wolfssh","vendor":"wolfSSL Inc.","versions":[{"lessThanOrEqual":"v1.4.16","status":"affected","version":"0","versionType":"release bundle"}]}],"source":"facts@wolfssl.com"},{"affectedData":[{"cpes":["cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"wolfssh","vendor":"wolfssh","versions":[{"lessThan":"1.4.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*","matchCriteriaId":"9F84F99B-681F-43B2-BEA5-B3ED6BFABC3D","versionEndExcluding":"1.4.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.\n"},{"lang":"es","value":"Se encontró una vulnerabilidad en la máquina de estado del lado del servidor de wolfSSH antes de las versiones 1.4.17. Un cliente malintencionado podría crear canales sin realizar primero la autenticación del usuario, lo que provocaría un acceso no autorizado."}],"id":"CVE-2024-2873","lastModified":"2026-06-17T07:25:43.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"facts@wolfssl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-08-01T19:41:19.753078Z","version":"2.0.3"}}]},"published":"2024-03-25T22:37:19.847","references":[{"source":"facts@wolfssl.com","tags":["Issue Tracking"],"url":"https://github.com/wolfSSL/wolfssh/pull/670"},{"source":"facts@wolfssl.com","tags":["Issue Tracking"],"url":"https://github.com/wolfSSL/wolfssh/pull/671"},{"source":"facts@wolfssl.com","tags":["Vendor Advisory"],"url":"https://www.wolfssl.com/docs/security-vulnerabilities/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/wolfSSL/wolfssh/pull/670"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/wolfSSL/wolfssh/pull/671"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.wolfssl.com/docs/security-vulnerabilities/"}],"sourceIdentifier":"facts@wolfssl.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"facts@wolfssl.com","type":"Secondary"}]}
|