« Volver al listado

CVE-2024-10394

Estado: ModificadaAlta (8.4)—

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L + UI:P indica ejecución en cliente local; impacto: robo de credenciales (T1528) y acceso a datos autenticados (T1552.007) mediante bypass del mecanismo PAG.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementUser TrainingRestrict Web-Based ContentPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Openafs — Openafs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10394",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10394",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-19T15:59:42.509613Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "patrick@puiterwijk.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "vendor": "The OpenAFS Foundation",
          "product": "OpenAFS",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "1.6.24",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.8.0",
              "lessThan": "1.8.12.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.9.0",
              "lessThan": "1.9.1",
              "versionType": "semver"
            }
          ],
          "packageName": "openafs",
          "collectionURL": "https://github.com/openafs/openafs/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-14T20:15:20.777",
  "references": [
    {
      "url": "https://www.openafs.org/pages/security/OPENAFS-SA-2024-001.txt",
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://www.openafs.org/security",
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG."
    },
    {
      "lang": "es",
      "value": "Un usuario local puede eludir el mecanismo de limitación de PAG (grupo de autenticación de procesos) de OpenAFS en clientes Unix, lo que le permite crear un PAG utilizando un número de identificación existente, uniéndose efectivamente al PAG y permitiendo al usuario robar las credenciales en ese PAG."
    }
  ],
  "lastModified": "2026-06-17T06:55:33.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68ADC2B6-C3E7-4CBB-8606-1E7BA75A6384",
              "versionEndExcluding": "1.6.25",
              "versionStartIncluding": "1.0"
            },
            {
              "criteria": "cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57A57597-4164-4BCC-BF28-2ECC802B1CE3",
              "versionEndExcluding": "1.8.13",
              "versionStartIncluding": "1.8.0"
            },
            {
              "criteria": "cpe:2.3:a:openafs:openafs:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4DAE782-78E7-494F-9456-FF6BE1598A36"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}