« Volver al listado

CVE-2024-6658

Estado: AnalizadaMedia (6.8)—

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects:

Product

Affected Versions

LoadMaster

From 7.2.55.0 to 7.2.60.0 (inclusive)

From 7.2.49.0 to 7.2.54.11 (inclusive)

7.2.48.12 and all prior versions

Multi-Tenant Hypervisor

7.1.35.11 and all prior versions

ECS

All prior versions to 7.2.60.0 (inclusive)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Progress — LoadmasterProgress — Multi-tenant Loadmaster

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6658",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6658",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T14:52:16.894185Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@progress.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@progress.com",
      "affectedData": [
        {
          "vendor": "Progress",
          "product": "LoadMaster",
          "versions": [
            {
              "status": "affected",
              "version": "All Previous Versions",
              "lessThan": "7.2.60.1",
              "versionType": "LoadMaster"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"
          ],
          "vendor": "kemptechnologies",
          "product": "loadmaster",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "7.2.48.12"
            },
            {
              "status": "affected",
              "version": "7.2.49.0",
              "lessThan": "7.2.54.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.2.55.0",
              "lessThan": "7.2.60.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:kemptechnologies:loadmaster_mt:*:*:*:*:*:*:*:*"
          ],
          "vendor": "kemptechnologies",
          "product": "loadmaster_mt",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.1.35.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-12T15:18:26.543",
  "references": [
    {
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/28910587250701",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@progress.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@progress.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects:\n\n\n\n Product \n\n\n\n\n\nAffected Versions \n\n\n\n\n\nLoadMaster \n\n\n\n\n\nFrom 7.2.55.0 to 7.2.60.0 (inclusive) \n\n\n\n\n\n  \n\n\n\n\n\nFrom 7.2.49.0 to 7.2.54.11 (inclusive) \n\n\n\n\n\n  \n\n\n\n\n\n7.2.48.12 and all prior versions \n\n\n\n\n\n\n\n\nMulti-Tenant Hypervisor \n\n\n\n\n\n7.1.35.11 and all prior versions \n\n\n\n\n\n\n\n\n\n\nECS\n\n\n\n\n\nAll prior versions to 7.2.60.0 (inclusive)"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de validación de entrada incorrecta de usuario autenticado en progreso LoadMaster permite la inyección de comandos del sistema operativo. Este problema afecta a: ?Producto Versiones afectadas LoadMaster De 7.2.55.0 a 7.2.60.0 (inclusive) ? De 7.2.49.0 a 7.2.54.11 (inclusive) ? 7.2.48.12 y todas las versiones anteriores Hipervisor multiinquilino 7.1.35.11 y todas las versiones anteriores ECS Todas las versiones anteriores a 7.2.60.0 (inclusive)"
    }
  ],
  "lastModified": "2026-06-17T08:18:26.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:multi-tenant_loadmaster:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16086A48-449E-49BB-BE86-C038FFB22C6B",
              "versionEndExcluding": "7.1.35.12"
            },
            {
              "criteria": "cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BF6DDA7-65D0-4678-8F19-CAB4A158EA25",
              "versionEndIncluding": "7.2.48.12"
            },
            {
              "criteria": "cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CEDCF3D-53EA-4DED-B62E-E594BCE165CE",
              "versionEndExcluding": "7.2.54.12",
              "versionStartIncluding": "7.2.49.0"
            },
            {
              "criteria": "cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29576F74-FD49-4181-BA9C-DBD3FC60B0D6",
              "versionEndExcluding": "7.2.60.1",
              "versionStartIncluding": "7.2.55.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@progress.com"
}