CVE-2024-9410 - Vulnerability Details - OpenCVE

ReportizFlow

Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Ada	Ada Ada.cx Sentry

Configuration 1 [-]

cpe:2.3:a:ada:ada:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.tenable.com/security/research/tra-2024-41

History

Fri, 22 Nov 2024 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ada ada
CPEs		cpe:2.3:a:ada:ada::::::::
Vendors & Products		Ada ada

Mon, 07 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ada Ada ada.cx Sentry
CPEs		cpe:2.3:a:ada:ada.cx_sentry::::::::
Vendors & Products		Ada Ada ada.cx Sentry
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 04 Oct 2024 13:30:00 +0000

Type	Values Removed	Values Added
Description		Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint.
Title		Ada.cx SSRF via Sentry Misconfiguration
Weaknesses		CWE-918
References		https://www.tenable.com/security/research/tra-2024-41
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: tenable

Published: 2024-10-04T13:23:19.190Z

Updated: 2024-10-04T18:15:58.083Z

Reserved: 2024-10-01T13:26:17.569Z

Link: CVE-2024-9410

Vulnrichment

Updated: 2024-10-04T18:08:37.150Z

NVD

Status : Analyzed

Published: 2024-10-04T14:15:05.577

Modified: 2024-11-22T19:57:28.770

Link: CVE-2024-9410

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9410", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "state": "PUBLISHED", "assignerShortName": "tenable", "dateReserved": "2024-10-01T13:26:17.569Z", "datePublished": "2024-10-04T13:23:19.190Z", "dateUpdated": "2024-10-04T18:15:58.083Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Ada.cx Sentry Component", "vendor": "Ada Support", "versions": [{"lessThan": "Prior to October 1, 2024", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint."}], "value": "Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2024-10-04T13:23:19.190Z"}, "references": [{"url": "https://www.tenable.com/security/research/tra-2024-41"}], "source": {"discovery": "UNKNOWN"}, "title": "Ada.cx SSRF via Sentry Misconfiguration", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "ada", "product": "ada.cx_sentry", "cpes": ["cpe:2.3:a:ada:ada.cx_sentry:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "10-1-2024", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-04T17:25:22.596170Z", "id": "CVE-2024-9410", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T18:15:58.083Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9410", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-04T17:25:22.596170Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ada:ada.cx_sentry:*:*:*:*:*:*:*:*"], "vendor": "ada", "product": "ada.cx_sentry", "versions": [{"status": "affected", "version": "0", "lessThan": "10-1-2024", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T18:08:37.150Z"}}], "cna": {"title": "Ada.cx SSRF via Sentry Misconfiguration", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ada Support", "product": "Ada.cx Sentry Component", "versions": [{"status": "affected", "version": "0", "lessThan": "Prior to October 1, 2024", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tenable.com/security/research/tra-2024-41"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint.", "supportingMedia": [{"type": "text/html", "value": "Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2024-10-04T13:23:19.190Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9410", "state": "PUBLISHED", "dateUpdated": "2024-10-04T18:15:58.083Z", "dateReserved": "2024-10-01T13:26:17.569Z", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "datePublished": "2024-10-04T13:23:19.190Z", "assignerShortName": "tenable"}, "dataVersion": "5.1"}