CVE-2024-6515CWE-319

unauthorized file access

High · published December 5, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

⚡ A web browser might be exposing your passwords in plain sight – and no one wants that! Imagine your sensitive keys left on the counter for anyone to grab. 🔓 Think of it like a restaurant that writes down your order on a sticky note and leaves it on the counter for the whole dining room to see. Instead of keeping your credentials secure, they are being laid out in the open, just waiting for someone to pick them up and use them! This vulnerability could lead to unintended credential exposure, allowing attackers to easily snatch usernames and passwords right out of the air. If exploited, it could mean not just lost accounts, but unauthorized access to sensitive systems and data. Yikes!

Put simply

Think of it like a restaurant that writes down your order on a sticky note and leaves it on the counter for the whole dining room to see. Instead of keeping your credentials secure, they are being laid out in the open, just waiting for someone to pick them up and use them! The problem lies in how the web browser interface in ABB ASPECT, NEXUS, and MATRIX Series applications can manipulate application usernames and passwords, either in clear text or Base64 encoding, making them susceptible to interception.

What to do

This vulnerability could lead to unintended credential exposure, allowing attackers to easily snatch usernames and passwords right out of the air. If exploited, it could mean not just lost accounts, but unauthorized access to sensitive systems and data. Yikes! To secure your environment, update to the latest version of ABB ASPECT, NEXUS, and MATRIX Series immediately. Additionally, review your application security policies to ensure sensitive information is handled securely and consider implementing encryption for data in transit. You've got this! By addressing this vulnerability swiftly, you’ll keep your credentials safe and sound. 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/S:N/AU:N/V:D/RE:L
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2024-12-05T12:22Z
EPSS history
Timeline
  • 05 DEC 12:22Z
    unauthorized file access
    cvelistv5