« Volver al listado

CVE-2024-11481

Estado: AnalizadaAlta (8.2)—

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N sin UI permite acceso remoto sin autenticación a API interna (T1190). Path traversal + falta de validación permite leer archivos internos (T1005) y potencialmente exponer credenciales/configuración (T1552).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementLimit Access to Resource Over NetworkFilter Network TrafficUpdate SoftwareActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (1)

Trellix — Enterprise Security Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-11481",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-11481",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-29T13:54:04.500847Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "Trellix",
          "product": "Trellix Enterprise Security Manager (ESM)",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.12"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:trellix:enterprise_security_manager:*:*:*:*:*:*:*:*"
          ],
          "vendor": "trellix",
          "product": "enterprise_security_manager",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.12"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-29T08:15:04.270",
  "references": [
    {
      "url": "https://thrive.trellix.com/s/article/000014058",
      "tags": [
        "Permissions Required"
      ],
      "source": "trellixpsirt@trellix.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en ESM 11.6.10 permite el acceso no autenticado a la API interna de Snowservice. Esto genera un manejo inadecuado de path traversal, un reenvío inseguro a un backend AJP sin la validación adecuada y una falta de autenticación para acceder a los endpoints de la API interna."
    }
  ],
  "lastModified": "2026-06-17T06:57:48.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trellix:enterprise_security_manager:11.6.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E938A5F5-8505-4AFD-BBC4-51B422551FAC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com"
}