JVNVU#98330908
Multiple products from Check Point Software Technologies vulnerable to information disclosure
Overview
Multiple products from Check Point Software Technologies contain an information disclosure vulnerability.
Products Affected
- CloudGuard Network
- Quantum Maestro
- Quantum Scalable Chassis
- Quantum Security Gateways
- Quantum Spark Appliances
CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Spark Appliances
- IPSec VPN Software Blade is enabled, and the Security Gateway is added to a Remote Access VPN community
- Mobile Access Software Blade is enabled
- Remote Access feature is enabled
For more details, refer to the information provided by the developer.
Description
Multiple products from Check Point Software Technologies contain an information disclosure vulnerability (CWE-200, CVE-2024-24919).
Impact
A remote attacker may obtain sensitive information stored in the product without authentication.
Solution
Apply the Hotfix
Apply the appropriate hotfix according to the information provided by the developer.
Apply the workarounds
The developer recommends applying workarounds in addition to applying the hotfix.
For more details, refer to the information provided by the developer.
Vendor Status
References
-
JPCERT/CC CyberNewsFlash 2024-05-30
Regarding Check Point Software Technologies VPN Information Disclosure vulnerability (CVE-2024-24919) (Text in Japanese)
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
---|---|---|---|---|
Attack Complexity(AC) | High (H) | Low (L) | ||
Privileges Required(PR) | High (H) | Low (L) | None (N) | |
User Interaction(UI) | Required (R) | None (N) | ||
Scope(S) | Unchanged (U) | Changed (C) | ||
Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
Integrity Impact(I) | None (N) | Low (L) | High (H) | |
Availability Impact(A) | None (N) | Low (L) | High (H) |
Credit
JPCERT/CC coordinated with Check Point Software Technologies to publish this advisory in order to notify users of this vulnerability.