« Volver al listado

CVE-2024-1156

Estado: AnalizadaAlta (7.8)—

Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (8)

Emerson — Data Record ADEmerson — FlexloggerEmerson — G WEB Development SoftwareEmerson — Labview NXGEmerson — Specification Compliance ManagerEmerson — Static Test Software SuiteEmerson — STS Software BundleEmerson — Systemlink Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-1156",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1156",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-20T16:33:13.523683Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ni.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ni.com",
      "affectedData": [
        {
          "vendor": "NI",
          "product": "SystemLink Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2023 Q3"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NI",
          "product": "FlexLogger",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2022 Q3"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "flexlogger",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2022_q3"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "systemlink",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2023_q3"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-02-20T15:15:09.910",
  "references": [
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security@ni.com"
    },
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ni.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges."
    },
    {
      "lang": "es",
      "value": "Los permisos de directorio incorrectos para el servicio NI RabbitMQ compartido pueden permitir que un usuario autenticado local lea la información de configuración de RabbitMQ y potencialmente habilitar la escalada de privilegios."
    }
  ],
  "lastModified": "2026-06-17T07:03:35.867",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emerson:data_record_ad:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2267E001-7C8A-4E3C-BAA3-C4108CDC2C11",
              "versionEndIncluding": "2.0.1"
            },
            {
              "criteria": "cpe:2.3:a:emerson:flexlogger:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A05CEECE-4F09-4875-97F5-D419044299B8",
              "versionEndIncluding": "2022_q3"
            },
            {
              "criteria": "cpe:2.3:a:emerson:g_web_development_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C4008CF-D7BB-4400-AF25-69A468E0274F",
              "versionEndIncluding": "2022_q3"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E84E23D5-04EB-4B73-B335-AD1F9ECA6166"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:real-time_module:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25474D7C-8523-49BF-8D83-5D82A0D95FD0"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:web_module:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06AE0E0E-8E3C-416F-97EC-308FB2953B56"
            },
            {
              "criteria": "cpe:2.3:a:emerson:specification_compliance_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18B58D78-41AA-484A-A184-DFA999ED504B",
              "versionEndIncluding": "2023_q4"
            },
            {
              "criteria": "cpe:2.3:a:emerson:static_test_software_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "338BAA7F-884C-41D8-B131-9E2C2FD46DC6",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:emerson:sts_software_bundle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B018440C-809C-4E30-9A08-AAF79D7D280E",
              "versionEndIncluding": "21.0"
            },
            {
              "criteria": "cpe:2.3:a:emerson:systemlink_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95CF6EFB-FED4-428A-8CE5-AAE9D12A64FB",
              "versionEndExcluding": "2024_q1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ni.com"
}