CVE-2024-56902
Published: 03 February 2025
Summary
CVE-2024-56902 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AU-13 (Monitoring for Information Disclosure).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
IA-5 mandates protection of authenticators like passwords from unauthorized disclosure and requires they not be stored or transmitted in cleartext, directly preventing exposure of cleartext credentials in the web application.
AC-14 explicitly limits and authorizes actions performable without identification or authentication, preventing unauthenticated remote access to endpoints disclosing account information.
AU-13 requires monitoring the system for unauthorized disclosures of sensitive information, enabling detection of exploitation attempts retrieving cleartext passwords.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing web app (T1190) exposes cleartext credentials (T1552).
NVD Description
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
Deeper analysisAI
CVE-2024-56902 is an information disclosure vulnerability in the Geovision GV-ASManager web application, affecting versions v6.1.0.0 and earlier. Classified under CWE-200, the issue enables the exposure of account information, including cleartext passwords. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and no prerequisites for authentication or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability by accessing the affected web application over the network. Exploitation requires low complexity and no user interaction, allowing the attacker to retrieve sensitive account details, such as usernames and plaintext passwords, which could facilitate unauthorized access to the GV-ASManager system or related resources.
Mitigation guidance and additional technical details are available in the advisory published on GitHub at https://github.com/DRAGOWN/CVE-2024-56902.
Details
- CWE(s)