Cyber Resilience

CVE-2024-6400

Finrota ≤ 1.21.10

Published
04 October 2024
Modified
03 June 2026
CVSS Score v4 8.2
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0063 47th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-6400 is a high-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Finrota Finrota. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-23 (Data Mining Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in versions 1.21.10, 1.23.01, 1.23.08,…

more

1.23.11 and 1.24.03.

CWE(s)
CWE-202CWE-312

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-21993Shared CWE-312
CVE-2025-59102Shared CWE-312
CVE-2025-44649Shared CWE-312
CVE-2025-53672Shared CWE-312
CVE-2025-54538Shared CWE-312
CVE-2026-36176Shared CWE-312
CVE-2024-28810Shared CWE-312
CVE-2023-27370Shared CWE-312
CVE-2024-9798Shared CWE-312
CVE-2023-32448Shared CWE-312

Affected Assets

finrota
finrota
≤ 1.21.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V14.2.8

Mitigating Controls (NIST 800-53 r5) AI

SC-28 Protection of Information at Rest good match

SC-28 requires cryptographic or equivalent protection of sensitive data at rest, directly stopping cleartext storage in accessible resources.

AC-23 Data Mining Protection good match

AC-23 directly requires mechanisms to protect against unauthorized data mining and inference from statistical queries that would expose sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 full match
prevents

Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.

PR.AA-05 mostly match
prevents

Least-privilege query permissions directly limit the data an attacker can request or infer.

DE.CM-03 partial match
prevents

Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.

PR.DS-10 partial match
prevents

Protecting data-in-use reduces what remains available for inference via queries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control mostly match
prevents

Access control limits who can run queries that could expose sensitive information via inference.

A.5.18 Access rights mostly match
prevents

Granular access rights reduce the ability of users to craft inference queries.

A.8.11 Data masking mostly match
prevents

Data masking prevents inference by obscuring sensitive values returned in query results.

A.8.3 Information access restriction mostly match
prevents

Information access restriction directly limits query scope that could lead to inference.

A.5.12 Classification of information partial match
mitigates

Classification helps identify sensitive data that must be protected from inference attacks.

A.7.14 Secure disposal or re-use of equipment partial match
mitigates

Requiring non-standard deletion or physical destruction of media ensures that sensitive information is not left in cleartext on discarded or repurposed equipment.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-312
Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-312
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-312

References