CVE-2024-25011

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25011", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2024-02-02T21:33:13.076Z", "datePublished": "2025-09-18T11:38:18.371Z", "dateUpdated": "2025-09-18T13:31:46.260Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Ericsson Catalog Manager", "vendor": "Ericsson", "versions": [{"changes": [{"at": "22.7", "status": "unaffected"}], "lessThanOrEqual": "22.6", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "Ericsson Order Care", "vendor": "Ericsson", "versions": [{"changes": [{"at": "22.7", "status": "unaffected"}], "lessThanOrEqual": "22.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue."}], "value": "Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2025-09-18T11:38:18.371Z"}, "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25011"}], "source": {"discovery": "UNKNOWN"}, "title": "Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "If you are unable to upgrade to the fixed versions where the required flag will be enabled by default, authentication checks can be configured under System Configuration to remediate the issue."}], "value": "If you are unable to upgrade to the fixed versions where the required flag will be enabled by default, authentication checks can be configured under System Configuration to remediate the issue."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-18T13:31:25.336493Z", "id": "CVE-2024-25011", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T13:31:46.260Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25011", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-18T13:31:25.336493Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T13:31:39.588Z"}}], "cna": {"title": "Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ericsson", "product": "Ericsson Catalog Manager", "versions": [{"status": "affected", "changes": [{"at": "22.7", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "22.6"}], "defaultStatus": "affected"}, {"vendor": "Ericsson", "product": "Ericsson Order Care", "versions": [{"status": "affected", "changes": [{"at": "22.7", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "22.6"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25011"}], "workarounds": [{"lang": "en", "value": "If you are unable to upgrade to the fixed versions where the required flag will be enabled by default, authentication checks can be configured under System Configuration to remediate the issue.", "supportingMedia": [{"type": "text/html", "value": "If you are unable to upgrade to the fixed versions where the required flag will be enabled by default, authentication checks can be configured under System Configuration to remediate the issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.", "supportingMedia": [{"type": "text/html", "value": "Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2025-09-18T11:38:18.371Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25011", "state": "PUBLISHED", "dateUpdated": "2025-09-18T13:31:46.260Z", "dateReserved": "2024-02-02T21:33:13.076Z", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "datePublished": "2025-09-18T11:38:18.371Z", "assignerShortName": "ERIC"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Ericsson Catalog Manager", "vendor": "Ericsson", "versions": [{"changes": [{"at": "22.7", "status": "unaffected"}], "lessThanOrEqual": "22.6", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "Ericsson Order Care", "vendor": "Ericsson", "versions": [{"changes": [{"at": "22.7", "status": "unaffected"}], "lessThanOrEqual": "22.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue."}, {"lang": "es", "value": "Las API de Ericsson Catalog Manager y Ericsson Order Care no tienen la autenticaci\u00f3n habilitada por defecto. Las comprobaciones de autenticaci\u00f3n se pueden configurar para remediar el problema de revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2024-25011", "lastModified": "2026-11-09T10:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-25011", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-18T13:31:25.336493Z", "version": "2.0.3"}}]}, "published": "2025-09-18T12:15:38.060", "references": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25011"}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}

{}

{"created": "2025-09-19T09:36:46.328501+00:00", "updated": "2025-09-19T09:36:46.328565+00:00", "vendors": ["ericsson", "ericsson$PRODUCT$catalog_manager", "ericsson$PRODUCT$order_care"]}