CVE-2024-24914

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-914

Affected software

Vendor	Product	Versions
checkpoint	ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management	Check Point Quantum Gateways versions R81, R81.10, R81.20
checkpoint	clusterxl	r81; r81.10; r81.20
checkpoint	multi-domain_management	r81; r81.10; r81.20
checkpoint	quantum_appliances	r81; r81.10; r81.20
checkpoint	quantum_maestro	r81; r81.10; r81.20
checkpoint	quantum_scalable_chassis	r81; r81.10; r81.20
checkpoint	quantum_security_gateway	r81; r81.10; r81.20
checkpoint	quantum_security_management	r81; r81.10; r81.20

References

https://support.checkpoint.com/results/sk/sk182743Vendor Advisory

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-249157.2Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole pro CVE-2024-249167.8Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's CVE-2024-249198.6Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled wit CVE-2024-24925.4The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all ver CVE-2024-249207.8A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write CVE-2024-249217.8A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application is vulnerable to memory corrupt CVE-2024-249227.8A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write CVE-2024-249237.8A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000), Simcenter Femap (All versions < V2306.0001). The affecte CVE-2024-249247.8A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write CVE-2024-249257.8A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized CVE-2024-249268.8Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affe CVE-2024-249276.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi