What is CVE-2024-6834?

CVE-2024-6834 is a critical-severity vulnerability in Open Mainframe Project Zowe, classified under CWE-250. CVSS score: 9.0/10. Published 2024-07-17.

How severe is CVE-2024-6834?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Is CVE-2024-6834 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Open Mainframe Project Zowe

CVE-2024-6834

A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.

EPSS: 0.003 (18.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Open Mainframe Project Zowe — versions 2.4.0

Weakness classification (CWE)

CWE-250

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

zowe-security@lists.openmainframeproject.org (product)

Frequently asked questions

What is CVE-2024-6834?: CVE-2024-6834 is a critical-severity vulnerability in Open Mainframe Project Zowe, classified under CWE-250. CVSS score: 9.0/10. Published 2024-07-17.
How severe is CVE-2024-6834?: Critical severity. CVSS v3 base score is 9.0 out of 10.
Is CVE-2024-6834 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.