Vulnerability record/PUBLISHED/Published Jul 31, 2024 16:56:06 UTC
CVE-2024-6977
A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.
Base score6.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeChangedS
Confidentiality impactHighC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityCato
Last updatedJul 31, 2024 17:08:09 UTC
PublishedJul 31, 2024 16:56:06 UTC
ReservedJul 22, 2024 10:18:14 UTC
Credits
- AmberWolf