« Volver al listado

CVE-2024-12057

Estado: AplazadaBaja (1.8)—

User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pcvue — Pcvue WEBAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-12057",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12057",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-10T21:22:40.386531Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 1.8,
          "Automatable": "NO",
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Clear",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "CLEAR",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "affectedData": [
        {
          "vendor": "arcinfo",
          "modules": [
            "Web Server Extensions"
          ],
          "product": "PcVue",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.2.4",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "15.2.11",
              "versionType": "cpe"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-09T19:15:12.750",
  "references": [
    {
      "url": "https://www.pcvue.com/security/#SB2024-6",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end.\nBy exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application."
    },
    {
      "lang": "es",
      "value": "Las credenciales de usuario (nombre de usuario y contraseña) se insertan en los archivos de registro cuando un usuario intenta autenticarse utilizando una versión de un cliente web que no es compatible con la del back end web de PcVue. Al explotar esta vulnerabilidad, un atacante podría recuperar las credenciales de un usuario accediendo al archivo de registro. La explotación exitosa de esta vulnerabilidad podría llevar a un acceso no autorizado a la aplicación."
    }
  ],
  "lastModified": "2026-06-17T06:58:58.060",
  "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
}