« Volver al listado

CVE-2024-8509

Estado: AplazadaAlta (7.5)—

A vulnerability was found in Forklift Controller.  There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Forklift — Forklift ControllerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8509",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8509",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-06T15:33:00.374909Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.6.6",
              "versionType": "semver"
            }
          ],
          "packageName": "forklift-controller",
          "collectionURL": "https://github.com/kubev2v/forklift",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:migration_toolkit_virtualization:2.6::el9",
            "cpe:/a:redhat:migration_toolkit_virtualization:2.6::el8"
          ],
          "vendor": "Red Hat",
          "product": "Migration Toolkit for Virtualization 2.6",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.6.6-2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "migration-toolkit-virtualization/mtv-api-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-09-06T16:15:03.583",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:6487",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-8509",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310406",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Forklift Controller.  There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Forklift Controller. No hay verificación con respecto al encabezado de autorización, excepto para garantizar que utilice autenticación de portador. Sin un encabezado de autorización y algún tipo de token de portador, se produce un error 401. La presencia de un valor de token proporciona una respuesta 200 con la información solicitada."
    }
  ],
  "lastModified": "2026-06-17T08:22:45.817",
  "sourceIdentifier": "secalert@redhat.com"
}