CVE-2024-5749 - Vulnerability Details - OpenCVE

Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hp	Designjet T730 Firmware Designjet T830 Firmware

No data.

No data.

References

Link	Providers
https://support.hp.com/us-en/document/ish_11428772-11428805-16/hpsbpi03979

History

Wed, 16 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hp Hp designjet T730 Firmware Hp designjet T830 Firmware
CPEs		cpe:2.3:o:hp:designjet_t730_firmware:::::::: cpe:2.3:o:hp:designjet_t830_firmware::::::::
Vendors & Products		Hp Hp designjet T730 Firmware Hp designjet T830 Firmware
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 15 Oct 2024 17:45:00 +0000

Type	Values Removed	Values Added
Description		Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.
Title		Certain HP DesignJet products – Credential reflection
Weaknesses		CWE-306
References		https://support.hp.com/us-en/document/ish_11428772-11428805-16/hpsbpi03979
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: hp

Published: 2024-10-15T17:27:51.556Z

Updated: 2024-10-16T15:00:57.473Z

Reserved: 2024-06-07T15:09:21.061Z

Link: CVE-2024-5749

Vulnrichment

Updated: 2024-10-16T15:00:44.404Z

NVD

Status : Awaiting Analysis

Published: 2024-10-15T18:15:05.997

Modified: 2024-10-16T16:38:43.170

Link: CVE-2024-5749

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5749", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "state": "PUBLISHED", "assignerShortName": "hp", "dateReserved": "2024-06-07T15:09:21.061Z", "datePublished": "2024-10-15T17:27:51.556Z", "dateUpdated": "2024-10-16T15:00:57.473Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Certain HP DesignJet products", "vendor": "HP Inc.", "versions": [{"status": "affected", "version": "See HP Security Bulletin reference for affected versions."}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.<br>"}], "value": "Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Sensitive Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2024-10-15T17:27:51.556Z"}, "references": [{"url": "https://support.hp.com/us-en/document/ish_11428772-11428805-16/hpsbpi03979"}], "source": {"discovery": "UNKNOWN"}, "title": "Certain HP DesignJet products \u2013 Credential reflection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "hp", "product": "designjet_t730_firmware", "cpes": ["cpe:2.3:o:hp:designjet_t730_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "candela_dist_pr2_001.2419b", "versionType": "custom"}]}, {"vendor": "hp", "product": "designjet_t830_firmware", "cpes": ["cpe:2.3:o:hp:designjet_t830_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "candela_dist_pr2_001.2419b", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T14:53:21.020887Z", "id": "CVE-2024-5749", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T15:00:57.473Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Certain HP DesignJet products \u2013 Credential reflection", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HP Inc.", "product": "Certain HP DesignJet products", "versions": [{"status": "affected", "version": "See HP Security Bulletin reference for affected versions."}], "defaultStatus": "unknown"}], "references": [{"url": "https://support.hp.com/us-en/document/ish_11428772-11428805-16/hpsbpi03979"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.", "supportingMedia": [{"type": "text/html", "value": "Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Sensitive Resource"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2024-10-15T17:27:51.556Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-16T14:53:21.020887Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:hp:designjet_t730_firmware:*:*:*:*:*:*:*:*"], "vendor": "hp", "product": "designjet_t730_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "candela_dist_pr2_001.2419b", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:hp:designjet_t830_firmware:*:*:*:*:*:*:*:*"], "vendor": "hp", "product": "designjet_t830_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "candela_dist_pr2_001.2419b", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-10-16T15:00:44.404Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-5749", "state": "PUBLISHED", "dateUpdated": "2024-10-15T17:27:51.556Z", "dateReserved": "2024-06-07T15:09:21.061Z", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "datePublished": "2024-10-15T17:27:51.556Z", "assignerShortName": "hp"}, "dataVersion": "5.1"}