Summary
Successful exploitation of these vulnerabilities could allow an attacker, under certain circumstances, to make application programming interface (API) calls to the OpenBlue Enterprise Manager Data Collector, which do not require authentication and may expose sensitive information to an unauthorized user.
Vulnerabilities 2
-
Critical 10.0CVE-2023-2024 Public exploit
Improper Authentication for OpenBlue Enterprise Manager Data Collector
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
-
Medium 5.0
Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector
OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
Revision history
-
#1
CSAF Creation Date
References
-
ICS Advisory ICSA-23-138-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/ics/Recommended-Practices
-
Recommended Practices
https://cisa.gov/ics