« Volver al listado

CVE-2024-32861

Estado: AplazadaAlta (7.8)—

Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Software House — C Cure 9000AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-16T14:55:26.330499Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "productsecurity@jci.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@jci.com",
      "affectedData": [
        {
          "vendor": "Johnson Controls",
          "product": "Software House C•CURE 9000 Installer",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.8"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:johnsoncontrols:software_house_c-cure_9000:*:*:*:*:*:*:*:*"
          ],
          "vendor": "johnsoncontrols",
          "product": "software_house_c-cure_9000",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.00.3"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-16T15:15:12.037",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/ICSA-24-191-05",
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories",
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/ICSA-24-191-05",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@jci.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions."
    },
    {
      "lang": "es",
      "value": "En determinadas circunstancias, Software House C?CURE 9000 Site Server proporciona una protección insuficiente de los directorios que contienen archivos ejecutables."
    }
  ],
  "lastModified": "2026-06-17T07:30:34.310",
  "sourceIdentifier": "productsecurity@jci.com"
}