« Volver al listado

CVE-2024-45770

Estado: AplazadaMedia (4.4)—

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Performance CO Pilot — Performance CO PilotAIPerformance CO Pilot — PmpostAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45770",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45770",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-19T13:39:14.632000Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "packageName": "pcp",
          "collectionURL": "https://github.com/performancecopilot/pcp",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.7-22.el8_10",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.2-9.el8_2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.7-19.el8_8",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.2.0-5.el9_4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.2.2-7.el9_5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.3.5-10.el9_0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.0.1-8.el9_2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-19T09:15:02.613",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6837",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6840",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6842",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6843",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6844",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6846",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6847",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6848",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:9452",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-45770",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310451",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Performance Co-Pilot (PCP). Esta falla solo se puede explotar si un atacante tiene acceso a una cuenta de sistema PCP comprometida. El problema está relacionado con la herramienta pmpost, que se utiliza para registrar mensajes en el sistema. En determinadas condiciones, se ejecuta con privilegios de alto nivel."
    }
  ],
  "lastModified": "2026-06-17T07:54:46.927",
  "sourceIdentifier": "secalert@redhat.com"
}