| CVE ID | CVE-2024-7265 |
| Publication date | 07 August 2024 |
| Vendor | Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy |
| Product | EZD RP |
| Vulnerable versions | From 15 to 15.84, from 16 before 16.15, from 17 before 17.2 |
| Vulnerability type (CWE) | Incorrect User Management (CWE-286) |
| Report source | NASK own research |
| CVE ID | CVE-2024-7266 |
| Publication date | 07 August 2024 |
| Vendor | Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy |
| Product | EZD RP |
| Vulnerable versions | From 15 to 15.84, from 16 before 16.15, from 17 before 17.2 |
| Vulnerability type (CWE) | Incorrect User Management (CWE-286) |
| Report source | NASK own research |
| CVE ID | CVE-2024-7267 |
| Publication date | 07 August 2024 |
| Vendor | Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy |
| Product | EZD RP |
| Vulnerable versions | All before 19.6 |
| Vulnerability type (CWE) | Exposure of Sensitive Information Due to Incompatible Policies (CWE-213) |
| Report source | NASK own research |
Description
CERT Polska has received a report about vulnerabilities in EZD RP software developed by NASK - PIB and participated in coordination of their disclosure.
The vulnerability CVE-2024-7265 allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. The vulnerability CVE-2024-7266 allows logged-in user to list all users in the system, including those from other organizations. These issues affect EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.
The vulnerability CVE-2024-7267 allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP in all versions before 19.6
Credits
We thank Jakub Płatek (NASK-PIB) for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.