CVE-2024-24914 Code injection in ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management
Authenticated users can inject code or commands via global variables in HTTP requests on Check Point security gateways.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24914?
CVE-2024-24914 is a high-severity code injection vulnerability in checkpoint ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management, published on 7 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.
Weakness: CWE-914
Which versions are affected by CVE-2024-24914?
It affects 1 product.
Products include Checkpoint Gaia Os.
How do I fix CVE-2024-24914?
No fix has been published for CVE-2024-24914 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-24914 being exploited?
There is no known exploitation of CVE-2024-24914 in the wild and no public exploit code.
Other vulnerabilities in checkpoint ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management
Sources
Also known as GHSA-jfqp-w655-72wj.