CVE-2024-3544
Assigner: ProgressSoftware
Published: 2024-05-02T14:08:06.683Z
State: PUBLISHED
affected: defaultStatus: affected
product: LoadMaster
vendor: Progress Software Corporation
versions: lessThan: 7.2.59.4
status: affected
version: LoadMaster 7.2.55.0 (GA)
versionType: semver
lessThan: 7.2.54.10
status: affected
version: LoadMaster 7.2.49.0 (LTSF)
versionType: semver
lessThan: 7.2.48.12
status: affected
version: LoadMaster 7.2.48.11 (LTS)
versionType: semver
credits: type: finder
value: Agenzia per la Cybersicurezza Nazionale (ACN)
descriptions: supportingMedia: base64: no
type: text/html
value: 

Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.


value: 
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.


impacts: capecId: CAPEC-115
descriptions: value: CAPEC-115: Authentication Bypass
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-798
description: CWE-798: Use of Hard-coded Credentials
type: CWE
source: discovery: UNKNOWN
title: LoadMaster Hardcoded SSH Key
x_generator: engine: Vulnogram 0.1.0-dev