In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs. This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1]
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Kura | 5.0.0 – 5.4.1 | — | No fix listed | CNA |
| — | org.eclipse.kura:org.eclipse.kura.web2 (Maven) | 2.0.600 – 2.4.0 | — | No fix listed | GHSA-frc2-w2cc-x794 |
- Kura VendorEclipse Foundation Affected 5.0.0 – 5.4.1 Fixed in — No fix listed CNA
- org.eclipse.kura:org.eclipse.kura.web2 (Maven) Vendor— Affected 2.0.600 – 2.4.0 Fixed in — No fix listed GHSA-frc2-w2cc-x794
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:* | 5.0.0 – 5.4.1 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.4.1 Vulnerable ·Eclipse Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3046
- 2026-10-03 Alias added: GHSA-frc2-w2cc-x794
References
More Eclipse Foundation Kura vulnerabilities
- TI-2017-05285 Improper authentication in Eclipse Kura Installer CVSS 3.0CRITICAL 9.8
- TI-2026-08399 Insufficient verification of data authenticity in Eclipse Kura CVSS 4.0HIGH 8.8
- TI-2019-07559 XML external entity injection in Eclipse Kura CVSS 3.0HIGH 7.5
- TI-2019-07557 Path traversal in Eclipse Kura CVSS 3.0MEDIUM 5.3
- TI-2019-07558 Information disclosure in Eclipse Kura CVSS 3.0MEDIUM 5.3
Sources
- CVE-2024-3046 · CVE Program
- CVE-2024-3046 · NVD
- FIRST EPSS
- GHSA-frc2-w2cc-x794 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences