CVE-2024-48939

Published: Nov 11, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.

Related CWEs

CWE-922

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References (4)

https://github.com/gitaware/CVE/blob/main/CVE-2024-48939/20241020_vuln_discl_paxton_API_license.pdf

Source: cve@mitre.org

https://paxton-access.co.uk

Source: cve@mitre.org

https://seclists.org/fulldisclosure/2024/Oct/3

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2024/Oct/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.