Vulnerability · Published Jun 25, 2024 · Assigned by Sonatype
CVE-2024-6060
Critical 9.3
In plain English
A critical-severity sensitive data in logs in Webscopes from Phloc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information.
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/AU:N/R:U/V:C/RE:M/U:Red
References
- https://www.sonatype.com/security-advisories/cve-2024-6060 third-party-advisory
- https://sites.google.com/sonatype.com/vulnerabilities/cve-2024-6060 third-party-advisory, x_transferred