Skip to content
OpenAdvisories
High ICSA-24-284-15 3 CVEs

Rockwell Automation DataMosaix Private Cloud

Published Oct 10, 2024 · Updated Oct 10, 2024

Vendor: Rockwell Automation Product: DataMosaix™ Private Cloud

Summary

Successful exploitation of these vulnerabilities could allow an attacker to view customer data or create, modify, or delete their own project.

Vulnerabilities 3

  • High 8.7
    CVE-2024-7952

    DataEdgePlatform DataMosaix™ Private Cloud

    A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data.

    Rockwell Automation DataEdgePlatform DataMosaix™ Private Cloud ICS / OT
  • High 8.7
    CVE-2024-7953

    DataEdgePlatform DataMosaix™ Private Cloud

    A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project.

    Rockwell Automation DataEdgePlatform DataMosaix™ Private Cloud ICS / OT
  • High 7.6
    CVE-2024-7956

    Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

    A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project.

    Rockwell Automation DataMosaix™ Private Cloud ICS / OT

Revision history

  1. #1

    Initial Publication

References