{"id":"CVE-2024-25659","state":"PUBLISHED","title":"In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access file","description":"In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory.","publishedAt":"2024-10-01T00:00:00.000Z","updatedAt":"2024-10-01T17:55:47.613Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25659"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/25xxx/CVE-2024-25659.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-25659","state":"PUBLISHED","datePublished":"2024-10-01T00:00:00.000Z","dateUpdated":"2024-10-01T17:55:47.613Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2024-02-09T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25659"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2024-10-01T15:08:27.927Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"infinera","product":"tnms","defaultStatus":"unknown","versions":[{"version":"19.10.3","status":"affected"}],"cpes":["cpe:2.3:a:infinera:tnms:19.10.3:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-01T17:53:28.475010Z","id":"CVE-2024-25659","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-01T17:55:47.613Z"}}]}}}