CVE-2024-6071 | PTC Creo Elements/Direct License Server exposes a web interf… | CVSS 10.0 CRITICAL

Description

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.

Metadata

CVE ID: CVE-2024-6071
State: PUBLISHED
Assigner: icscert
Reserved: 2024-06-17 15:17 UTC
Published: 2024-06-27 23:05 UTC
Last updated: 2024-08-01 21:25 UTC
Primary CWE: CWE-862
CWE-862 Missing Authorization
Vendor / Product: PTC / Creo Elements/Direct License
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
PTC	Creo Elements/Direct License	—	0 ≤ 20.7.0.0

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862 Missing Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)