CVE-2024-24919
Information disclosure
Check Point Quantum Security Gateways Information Disclosure Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA notes
https://support.checkpoint.com/results/sk/sk182336 ; https://nvd.nist.gov/vuln/detail/CVE-2024-24919
Description
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| checkpoint | Check Point Quantum Gateway, Spark Gateway and CloudGuard Network | Check Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20. |
References
1 LinksRecord Details
More from checkpoint
Authentication Bypass in the SmartConsole Login Process Using an Application Token
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
Improper Certificate Validation in Quantum Security Gateway
User Authentication Bypass in VPN Remote Access and Mobile Access
Related Tool Categories
Tool categories that test for or protect against this vulnerability class.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.