Vulnerability · Published Oct 3, 2024 · Assigned by hpe
CVE-2024-42504HPE IceWall Agent products, Cross-Site Request Forgery (CSRF)
Medium 4.3
In plain English
A medium-severity cross-site request forgery in HPE IceWall Agent products from Hewlett Packard Enterprise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise | HPE IceWall Agent products | IceWall Federation Agent – before 4.0IceWall Gen11 Enterprise Edition – before 11IceWall SSO Agent Option – before 10 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N