超危
ScienceLogic SL1安全漏洞
2024-10-18 14:45:02 公开 ，2026-02-28 04:53:10 更新
- CISA KEV
- 关键漏洞
- 无需认证
- 远程
- 公开PoC
- CWEs：
- CWE-829 （Inclusion of Functionality from Untrusted Control Sphere）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：是技术影响评估：全部 2024-10-21 23:09:27
风险信息
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 9.8
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 9.8
- CVSS v4.0 向量
- AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
- CVSS v4.0 风险值
- 9.3
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- ScienceLogic SL1（原名EM7）受到一个涉及与SL1打包的未指定第三方组件的未指定漏洞的影响。
- 修复建议
- 该漏洞在SL1版本12.1.3+、12.2.3+和12.3+中得到了解决。针对所有SL1版本，包括回溯到版本线10.1.x、10.2.x、11.1.x、11.2.x和11.3.x的补救措施已经可用。参考链接： https://support.sciencelogic.com/s/article/15465 https://support.sciencelogic.com/s/article/15527
参考链接
- https://twitter.com/ynezzor/status/1839931641172467907
CVE · Third Party Advisory
- https://www.theregister.com/2024/09/30/rackspace_zero_day_attack/
CVE · media-coverage
- https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility/
CVE · third-party-advisory
- https://www.bleepingcomputer.com/news/security/rackspace-monitoring-data-stolen-in-sciencelogic-zero-day-attack/
CVE · media-coverage
- https://support.sciencelogic.com/s/article/15465
CVE · vendor-advisory
- https://support.sciencelogic.com/s/article/15527
CVE · vendor-advisory
- https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6
CVE · Third Party Advisory
- https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690
CVE · release-notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9537
CVE · government-resource
- https://cxsecurity.com/cveshow/CVE-2024-9537/
CNNVD
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9537
NVD · US Government Resource