« Volver al listado

CVE-2024-6360

Estado: AnalizadaMedia (6.9)—

Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microfocus — VerticaOpentext — Vertica

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6360",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6360",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T16:23:57.623653Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 6.9,
          "Automatable": "YES",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "OpenText™",
          "product": "Vertica",
          "versions": [
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.x"
            },
            {
              "status": "affected",
              "version": "11.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.x"
            },
            {
              "status": "affected",
              "version": "12.0",
              "versionType": "custom",
              "lessThanOrEqual": "12.x"
            },
            {
              "status": "affected",
              "version": "23.0",
              "versionType": "custom",
              "lessThanOrEqual": "23.x"
            },
            {
              "status": "affected",
              "version": "24.0",
              "versionType": "custom",
              "lessThanOrEqual": "24.x"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-02T16:15:11.103",
  "references": [
    {
      "url": "https://portal.microfocus.com/s/article/KM000033373?language=en_US",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@opentext.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey.\nThis issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de asignación incorrecta de permisos para recursos críticos en OpenText™ Vertica podría permitir el abuso de privilegios y dar como resultado el acceso no autorizado o los privilegios a la clave API del agente de Vertica. Este problema afecta a Vertica: de la versión 10.0 a la 10.X, de la versión 11.0 a la 11.X, de la versión 12.0 a la 12.X, de la versión 23.0 a la 23.X, de la versión 24.0 a la 24.X."
    }
  ],
  "lastModified": "2026-06-17T08:17:51.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:vertica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4A97CBA-CE91-4F9F-9A85-6FD7E648E330",
              "versionEndExcluding": "12.0.4-30",
              "versionStartIncluding": "10.0.0-0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:vertica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8474396A-2075-4DC5-A0AD-EE68273DAD9D",
              "versionEndExcluding": "23.3.0-11",
              "versionStartIncluding": "23.0.0-0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:vertica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4B94CC9-3617-46F7-843A-129A00BD8D7B",
              "versionEndExcluding": "23.4.0-13",
              "versionStartIncluding": "23.4.0-0"
            },
            {
              "criteria": "cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D740B9B2-4F80-4D55-8B00-73B82CCC1CD1",
              "versionEndExcluding": "24.1.0-8",
              "versionStartIncluding": "24.1.0-0"
            },
            {
              "criteria": "cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DD94CBC-CA6B-469A-8395-C5A833C54DDB",
              "versionEndExcluding": "24.2.0-4",
              "versionStartIncluding": "24.2.0-0"
            },
            {
              "criteria": "cpe:2.3:a:opentext:vertica:24.3.0-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63B12357-FB4A-437D-AAD2-EC5BB7E0D789"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}