Conformance validation endpoint discloses detail about service to unauthenticated users
Priority LOW 29CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed Zowe (Open Mainframe Project): 2.17.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Zowe (Open Mainframe Project) Fixed in 2.17.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9802
- 2026-10-03 Alias added: GHSA-v9w7-jfhc-2mj9
References
More backstage Zowe Api Mediation Layer vulnerabilities
- TI-2024-09093 Health endpoint offers list of onboarded services to unauthenticated users CVSS 3.1MEDIUM 5.3
- TI-2021-03172 Improper privilege management in backstage Zowe CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-9802 · CVE Program
- CVE-2024-9802 · NVD
- FIRST EPSS
- GHSA-v9w7-jfhc-2mj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences