{"id":"CVE-2024-9412","state":"PUBLISHED","title":"Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager","description":"An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.","publishedAt":"2024-10-08T19:24:41.136Z","updatedAt":"2024-10-08T20:01:06.815Z","severity":{"score":8.4,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation Verve® Asset Manager"],"affected":[{"vendor":"Rockwell Automation","product":"Verve® Asset Manager","defaultStatus":"unaffected","versions":[{"version":"All versions < 1.38","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html"],"weaknesses":["CWE-842"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/9xxx/CVE-2024-9412.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-9412","state":"PUBLISHED","datePublished":"2024-10-08T19:24:41.136Z","dateUpdated":"2024-10-08T20:01:06.815Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2024-10-01T15:56:42.546Z"},"containers":{"cna":{"title":"Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager","descriptions":[{"lang":"en","value":"An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to."}],"affected":[{"vendor":"Rockwell Automation","product":"Verve® Asset Manager","defaultStatus":"unaffected","versions":[{"version":"All versions < 1.38","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.4,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-842","description":"CWE-842: Placement of User into Incorrect Group","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2024-10-08T19:24:41.136Z"},"datePublic":"2024-10-08T19:20:00.000Z","impacts":[{"capecId":"CAPEC-576","descriptions":[{"lang":"en","value":"CAPEC-576 Group Permission Footprinting"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"



Affected Product

 

 

 

 

Affected Versions

 

 

 

 

Corrected in software version

 

 

 

 

Verve® Asset Manager

 

 

 

 

All versions < 1.38

 

 

     

V1.38

 

\n\n
"}],"value":"Affected Product\n\n \n\n \n\n \n\n \n\nAffected Versions\n\n \n\n \n\n \n\n \n\nCorrected in software version\n\n \n\n \n\n \n\n \n\nVerve® Asset Manager \n\n \n\n \n\n \n\n \n\nAll versions < 1.38\n\n \n\n \n\n     \n\nV1.38"}],"source":{"advisory":"SD1704","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"rockwellautomation","product":"verve_asset_manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:verve_asset_manager:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-08T19:53:46.190123Z","id":"CVE-2024-9412","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-08T20:01:06.815Z"}}]}}}