CVSS 3.1 Score 7.5 of 10 (high)


Published Apr 9, 2024
Updated: Apr 10, 2024
CWE ID 303


CVE-2024-3046 is a vulnerability that affects Eclipse Kura LogServlet component versions 5.0.0 to 5.4.1. An unauthenticated user can exploit this vulnerability by sending a specially crafted request to the servlet, allowing them to retrieve device logs. The downloaded logs may then be used by an attacker to perform privilege escalation using the session ID of an authenticated user found in the logs. The affected products include org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1]. This vulnerability has a base severity rating of HIGH and poses a potential danger to organizations as it allows unauthorized access to sensitive device logs, potentially leading to further security breaches or unauthorized actions within the organization's systems. Remediation measures should be taken promptly to address this vulnerability and ensure the security of affected systems and data.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-3046 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options