{"id":"CVE-2024-2377","state":"PUBLISHED","title":"A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged action","description":"A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.","publishedAt":"2024-04-30T12:55:20.956Z","updatedAt":"2024-08-01T19:11:53.467Z","severity":{"score":7.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","source":"Hitachi Energy"},"assigner":"Hitachi Energy","products":["Hitachi Energy SDM600"],"affected":[{"vendor":"Hitachi Energy","product":"SDM600","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.4","versionType":"custom"},{"version":"1.3.4.572","status":"unaffected"}]}],"references":["https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true"],"weaknesses":["CWE-346"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/2xxx/CVE-2024-2377.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-2377","state":"PUBLISHED","datePublished":"2024-04-30T12:55:20.956Z","dateUpdated":"2024-08-01T19:11:53.467Z","assignerShortName":"Hitachi Energy","assignerOrgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateReserved":"2024-03-11T14:03:45.510Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information."}],"affected":[{"vendor":"Hitachi Energy","product":"SDM600","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.4","versionType":"custom"},{"version":"1.3.4.572","status":"unaffected"}]}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"CWE-346 Origin Validation Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi Energy","orgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateUpdated":"2024-04-30T12:55:20.956Z"},"impacts":[{"capecId":"CAPEC-234","descriptions":[{"lang":"en","value":"CAPEC-234 Hijacking a privileged process"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"hitachienergy","product":"sdm600","defaultStatus":"unknown","versions":[{"version":"-","status":"affected","lessThan":"1.3.4.572","versionType":"custom"}],"cpes":["cpe:2.3:h:hitachienergy:sdm600:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-2377","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-05-01T14:38:02.963543Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:30:39.392Z"}},{"title":"CVE Program Container","references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T19:11:53.467Z"}}]}}}