CVE-2024-9133 - Vulnerability Details - OpenCVE

A user with administrator privileges is able to retrieve authentication tokens

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Arista	Ng Firewall

Configuration 1 [-]

cpe:2.3:a:arista:ng_firewall:*:*:*:*:*:*:*:*

No data.

No data.

References

Link	Providers
https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105

History

Mon, 29 Sep 2025 12:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arista Arista ng Firewall
CPEs		cpe:2.3:a:arista:ng_firewall::::::::
Vendors & Products		Arista Arista ng Firewall

Mon, 13 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 10 Jan 2025 21:45:00 +0000

Type	Values Removed	Values Added
Description		A user with administrator privileges is able to retrieve authentication tokens
Title		A user with administrator privileges is able to retrieve authentication tokens
Weaknesses		CWE-287
References		https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Arista

Published: 2025-01-10T21:40:24.875Z

Updated: 2025-01-13T17:50:10.084Z

Reserved: 2024-09-23T22:01:02.674Z

Link: CVE-2024-9133

Vulnrichment

Updated: 2025-01-13T17:47:26.182Z

NVD

Status : Analyzed

Published: 2025-01-10T22:15:26.907

Modified: 2025-09-29T12:35:15.230

Link: CVE-2024-9133

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9133", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2024-09-23T22:01:02.674Z", "datePublished": "2025-01-10T21:40:24.875Z", "dateUpdated": "2025-01-13T17:50:10.084Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Arista Edge Threat Management", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "17.1.1", "status": "affected", "version": "17.1.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No required configuration.</span><br>"}], "value": "No required configuration."}], "credits": [{"lang": "en", "type": "finder", "value": "Mehmet INCE from PRODAFT.com"}], "datePublic": "2024-10-29T20:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A user with administrator privileges is able to retrieve authentication tokens</span><br>"}], "value": "A user with administrator privileges is able to retrieve authentication tokens"}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-01-10T21:40:24.875Z"}, "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.</div><ul><li>17.2 Upgrade</li></ul>"}], "value": "The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.\n\n * 17.2 Upgrade"}], "source": {"advisory": "105", "defect": ["NGFW-14800"], "discovery": "EXTERNAL"}, "title": "A user with administrator privileges is able to retrieve authentication tokens", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No known mitigation.</span><br>"}], "value": "No known mitigation."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-13T17:50:01.347130Z", "id": "CVE-2024-9133", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-13T17:50:10.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9133", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-13T17:50:01.347130Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-13T17:47:26.182Z"}}], "cna": {"title": "A user with administrator privileges is able to retrieve authentication tokens", "source": {"defect": ["NGFW-14800"], "advisory": "105", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mehmet INCE from PRODAFT.com"}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "Arista Edge Threat Management", "versions": [{"status": "affected", "version": "17.1.0", "versionType": "custom", "lessThanOrEqual": "17.1.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.\n\n * 17.2 Upgrade", "supportingMedia": [{"type": "text/html", "value": "<div>The recommended resolution for all issues documented above is to upgrade to the version indicated below at your earliest convenience.</div><ul><li>17.2 Upgrade</li></ul>", "base64": false}]}], "datePublic": "2024-10-29T20:20:00.000Z", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105"}], "workarounds": [{"lang": "en", "value": "No known mitigation.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No known mitigation.</span><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A user with administrator privileges is able to retrieve authentication tokens", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A user with administrator privileges is able to retrieve authentication tokens</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287"}]}], "configurations": [{"lang": "en", "value": "No required configuration.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">No required configuration.</span><br>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-01-10T21:40:24.875Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9133", "state": "PUBLISHED", "dateUpdated": "2025-01-13T17:50:10.084Z", "dateReserved": "2024-09-23T22:01:02.674Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2025-01-10T21:40:24.875Z", "assignerShortName": "Arista"}, "dataVersion": "5.1"}