CVE-2024-3046 Eclipse Kura LogServlet vulnerability

What is CVE-2024-3046?

CVE-2024-3046 is a high-severity vulnerability in Eclipse Foundation Kura, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs.

This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1]

Weakness: CWE-303

Which versions are affected by CVE-2024-3046?

2 open source packages ship an affected version, including org.eclipse.kura:org.eclipse.kura.web2. It affects 1 product.

Products include Eclipse Kura.

How do I fix CVE-2024-3046?

No fix has been published for CVE-2024-3046 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3046 being exploited?

There is no known exploitation of CVE-2024-3046 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Foundation Kura

• CVE-2017-7649 Auth bypass in Eclipse Kura Installer Critical 9.8
• CVE-2026-9561 Security feature bypass in Eclipse Kura High 8.8
• CVE-2019-10244 XML external entity in Eclipse Kura High 7.5
• CVE-2019-10242 Path traversal in Eclipse Kura Medium 5.3
• CVE-2019-10243 Information disclosure in Eclipse Kura Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-frc2-w2cc-x794.