CVE-2024-2244

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocation. The anomaly doesn’t exist with other credential combinations.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Hitachi EnergyAsset Suite EAM>= 9.6.3.0, < 9.6.3.13; >= 9.6.4.0, < 9.6.4.1
hitachienergyasset_suite>= 9.6.3.0, < 9.6.3.13
hitachienergyasset_suite>= 9.6.4.0, < 9.6.4.1

References

Timeline

Published
Mar 27, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-224406.8A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosureCVE-2024-224419.8HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass.CVE-2024-224429.8The vulnerability could be remotely exploited to bypass authentication.CVE-2024-224438.8A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conCVE-2024-224446.1A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflCVE-2024-224457.2Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. A remote high privileged atCVE-2024-224477.8Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially eCVE-2024-224484.4Dell BIOS contains an Out-of-Bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploiCVE-2024-224497.8Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. A low privilegCVE-2024-22456.1Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload CVE-2024-224507.8Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A local malicious user CVE-2024-224516.7Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentia