CVE-2024-41700 - Vulnerability Details

Vendors	Products
Barix	Sip Client Firmware Sip Client Web Management Interface Ui

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

Type	Values Removed	Values Added
First Time appeared		Barix sip Client Firmware
CPEs		cpe:2.3:o:barix:sip_client_firmware:-:::::::*
Vendors & Products		Barix sip Client Firmware

Type	Values Removed	Values Added
First Time appeared		Barix Barix sip Client Web Management Interface Ui
CPEs		cpe:2.3:a:barix:sip_client_web_management_interface_ui::::::::
Vendors & Products		Barix Barix sip Client Web Management Interface Ui
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Title		Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Weaknesses		CWE-200
References		https://www.gov.il/en/Departments/faq/cve_advisories
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-41700", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-07-21T07:20:40.644Z", "datePublished": "2024-08-20T12:05:10.315Z", "dateUpdated": "2024-08-21T19:41:24.503Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Barix SIP Client Web Management Interface UI", "vendor": "Barix", "versions": [{"lessThan": "Upgrade to a newer version, or limit access to management port", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD"}], "datePublic": "2024-08-20T11:49:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}], "value": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-20T12:05:10.315Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><div><div><div>\n\n\n\n<div><div><div><div><div><div>\n\n<div><div><div><div><div><div>Product is EOL. Upgrade to a newer version, or limit access to management port</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>"}], "value": "Product is EOL. Upgrade to a newer version, or limit access to management port"}], "source": {"advisory": "ILVN-2024-0184", "discovery": "UNKNOWN"}, "title": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "barix", "product": "sip_client_web_management_interface_ui", "cpes": ["cpe:2.3:a:barix:sip_client_web_management_interface_ui:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.07", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-21T19:38:24.298883Z", "id": "CVE-2024-41700", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T19:41:24.503Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-41700 (string)

assignerOrgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

state : PUBLISHED (string)

assignerShortName : INCD (string)

dateReserved : 2024-07-21T07:20:40.644Z (string)

datePublished : 2024-08-20T12:05:10.315Z (string)

dateUpdated : 2024-08-21T19:41:24.503Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Barix SIP Client Web Management Interface UI (string)

vendor : Barix (string)

versions : [ »

0 : { »

lessThan : Upgrade to a newer version, or limit access to management port (string)

status : affected (string)

version : All versions (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD (string)

}

]

datePublic : 2024-08-20T11:49:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

}

]

value : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-200 (string)

description : CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

shortName : INCD (string)

dateUpdated : 2024-08-20T12:05:10.315Z (string)

}

references : [ »

0 : { »

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <div><div><div><div><div><div> <div><div><div><div><div><div> <div><div><div><div><div><div>Product is EOL. Upgrade to a newer version, or limit access to management port</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div> (string)

}

]

value : Product is EOL. Upgrade to a newer version, or limit access to management port (string)

}

]

source : { »

advisory : ILVN-2024-0184 (string)

discovery : UNKNOWN (string)

}

title : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : barix (string)

product : sip_client_web_management_interface_ui (string)

cpes : [ »

0 : cpe:2.3:a:barix:sip_client_web_management_interface_ui:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 2.07 (string)

status : affected (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-21T19:38:24.298883Z (string)

id : CVE-2024-41700 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-21T19:41:24.503Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41700", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-21T19:38:24.298883Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:barix:sip_client_web_management_interface_ui:*:*:*:*:*:*:*:*"], "vendor": "barix", "product": "sip_client_web_management_interface_ui", "versions": [{"status": "affected", "version": "2.07"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T19:41:18.270Z"}}], "cna": {"title": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "source": {"advisory": "ILVN-2024-0184", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Barix", "product": "Barix SIP Client Web Management Interface UI", "versions": [{"status": "affected", "version": "All versions", "lessThan": "Upgrade to a newer version, or limit access to management port", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Product is EOL. Upgrade to a newer version, or limit access to management port", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><div><div>\n\n\n\n<div><div><div><div><div><div>\n\n<div><div><div><div><div><div>Product is EOL. Upgrade to a newer version, or limit access to management port</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>", "base64": false}]}], "datePublic": "2024-08-20T11:49:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "supportingMedia": [{"type": "text/html", "value": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-08-20T12:05:10.315Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41700", "state": "PUBLISHED", "dateUpdated": "2024-08-21T19:41:24.503Z", "dateReserved": "2024-07-21T07:20:40.644Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-08-20T12:05:10.315Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-41700 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-21T19:38:24.298883Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:barix:sip_client_web_management_interface_ui:*:*:*:*:*:*:*:* (string)

]

vendor : barix (string)

product : sip_client_web_management_interface_ui (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.07 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-21T19:41:18.270Z (string)

}

]

cna : { »

title : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

source : { »

advisory : ILVN-2024-0184 (string)

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Barix (string)

product : Barix SIP Client Web Management Interface UI (string)

versions : [ »

0 : { »

status : affected (string)

version : All versions (string)

lessThan : Upgrade to a newer version, or limit access to management port (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Product is EOL. Upgrade to a newer version, or limit access to management port (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <div><div><div><div><div><div> <div><div><div><div><div><div> <div><div><div><div><div><div>Product is EOL. Upgrade to a newer version, or limit access to management port</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div> (string)

base64 : false (boolean)

}

]

}

]

datePublic : 2024-08-20T11:49:00.000Z (string)

references : [ »

0 : { »

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-200 (string)

description : CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

}

]

}

]

providerMetadata : { »

orgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

shortName : INCD (string)

dateUpdated : 2024-08-20T12:05:10.315Z (string)

}

cveMetadata : { »

cveId : CVE-2024-41700 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-21T19:41:24.503Z (string)

dateReserved : 2024-07-21T07:20:40.644Z (string)

assignerOrgId : a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f (string)

datePublished : 2024-08-20T12:05:10.315Z (string)

assignerShortName : INCD (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barix:sip_client_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8EEBDE9E-57D1-4C54-8675-9C521938F0D7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Barix \u2013 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}, {"lang": "es", "value": "Barix \u2013 CWE-200 Exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado"}], "id": "CVE-2024-41700", "lastModified": "2024-09-03T19:37:12.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@cyber.gov.il", "type": "Secondary"}]}, "published": "2024-08-20T12:15:07.143", "references": [{"source": "cna@cyber.gov.il", "tags": ["Third Party Advisory"], "url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "sourceIdentifier": "cna@cyber.gov.il", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cna@cyber.gov.il", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:barix:sip_client_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8EEBDE9E-57D1-4C54-8675-9C521938F0D7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (string)

}

1 : { »

lang : es (string)

value : Barix – CWE-200 Exposición de información confidencial a un actor no autorizado (string)

}

]

id : CVE-2024-41700 (string)

lastModified : 2024-09-03T19:37:12.273 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : cna@cyber.gov.il (string)

type : Secondary (string)

}

]

}

published : 2024-08-20T12:15:07.143 (string)

references : [ »

0 : { »

source : cna@cyber.gov.il (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.gov.il/en/Departments/faq/cve_advisories (string)

}

]

sourceIdentifier : cna@cyber.gov.il (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : cna@cyber.gov.il (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object