CVE-2024-6977 - Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover

Back Back to CVE browser

MEDIUM

Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover

Published Jul 31, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.

Affected products

Vendor Cato Networks Product SDP Client Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.10.28

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cato Networks

SDP Client

unaffected

Version	Status	Constraints
0	affected	<5.10.28

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-532

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47959		Advisory
https://support.catonetworks.com/hc/en-us/articles/19766795729437-CVE-2024-6977-Windows-SDP-Client-Sensitive-data-in-trace-logs-can-lead-to-account-takeover		ExploitVendor Advisory