Vulnerability · Published Nov 7, 2024 · Assigned by VulDB

CVE-2024-10965emqx neuron JSON File schema information disclosure

Medium 4.3

In plain English

A medium-severity information exposure in neuron from emqx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The patch is named c9ce39747e0372aaa2157b2b56174914a12c06d8. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
emqx	neuron	2.02.12.22.32.42.52.62.7

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-283411 | emqx neuron JSON File schema information disclosure vdb-entry
VDB-283411 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #435375 | emqx neuron neuron version ≤ 2.10.0 Arbitrary JSON File Read third-party-advisory
https://github.com/emqx/neuron/issues/2281 issue-tracking
https://github.com/emqx/neuron/pull/2282 issue-tracking
https://github.com/fengzeroz/neuron/commit/c9ce39747e0372aaa2157b2b56174914a12c06d8 patch