Skip to main content

Pavilion8 CVE-2024-40620

MEDIUM
Missing Encryption of Sensitive Data (CWE-311)
2024-08-14 PSIRT@rockwellautomation.com
Information Disclosure Pavilion8
5.3
CVSS 4.0 · Vendor: rockwellautomation
Share

Severity by source

Vendor (rockwellautomation) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (rockwellautomation) · only source for this CVE.

CVSS VectorVendor: rockwellautomation

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Aug 14, 2024 - 20:15 cve.org
MEDIUM 5.3

DescriptionCVE.org

CVE-2024-40620 IMPACT

A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.

AnalysisAI

CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-311. CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality. Affected products include: Rockwellautomation Pavilion8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pavilion8

View all
CVE-2024-7960 HIGH
8.8 Sep 12

The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive informati
CVE-2024-6435 HIGH
8.7 Jul 16

A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privi
CVE-2024-7961 HIGH
8.6 Sep 12

A path traversal vulnerability exists in the Rockwell Automation affected product. Rated high severity (CVSS 8.6), this

CVE-2023-29463 MEDIUM
5.4 Sep 12

The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentica

Same weakness CWE-311 – Missing Encryption of Sensitive Data

View all
CVE-2017-8221 HIGH POC
7.5
CVE-2019-11367 CRITICAL POC
9.8
CVE-2025-69969 CRITICAL POC
9.6
CVE-2019-18800 HIGH POC
8.8
CVE-2017-6445 HIGH POC
8.1
CVE-2019-5448 HIGH POC
8.1
CVE-2018-5261 HIGH POC
8.1
CVE-2022-26281 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-40620 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy