Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privilege escalation. An attacker could exploit this vulnerability to gain access to sensitive information which may include system or user privileges. Exploitation of this issue does not require user interaction.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Adobe Framemaker Publishing Server | up to 2022.2 | — | No fix listed | CNA |
- Adobe Framemaker Publishing Server VendorAdobe Affected up to 2022.2 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:framemaker_publishing_server:*:*:*:*:*:*:*:* | before 2020 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2020:-:*:*:*:*:*:* | 2020 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2020:update1:*:*:*:*:*:* | 2020 update1 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2020:update2:*:*:*:*:*:* | 2020 update2 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2020:update3:*:*:*:*:*:* | 2020 update3 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2022:-:*:*:*:*:*:* | 2022 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2022:update1:*:*:*:*:*:* | 2022 update1 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2022:update2:*:*:*:*:*:* | 2022 update2 | Vulnerable | Adobe |
- cpe:2.3:a:adobe:framemaker_publishing_server:*:*:*:*:*:*:*:* Versions before 2020 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2020:-:*:*:*:*:*:* Versions 2020 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2020:update1:*:*:*:*:*:* Versions 2020 update1 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2020:update2:*:*:*:*:*:* Versions 2020 update2 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2020:update3:*:*:*:*:*:* Versions 2020 update3 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2022:-:*:*:*:*:*:* Versions 2022 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2022:update1:*:*:*:*:*:* Versions 2022 update1 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2022:update2:*:*:*:*:*:* Versions 2022 update2 Vulnerable ·Adobe
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Adobe Framemaker Publishing Server — helpx.adobe.com/security/products/framemaker-publishing-ser…
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2024-20043 Tenable Vulnerability Disclosure | API Auth BypassPriority MEDIUM 51
Timeline
- 2026-10-02 Threatist record created from CVE-2024-30300
- 2026-10-03 Alias added: GHSA-m388-cvx4-q52g
References
More Adobe Framemaker Publishing Server vulnerabilities
- TI-2024-13541 Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypass CVSS 3.1CRITICAL 9.8
- TI-2023-23841 ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-20043 Tenable Vulnerability Disclosure | API Auth Bypass CVSS 3.1CRITICAL 10.0
Sources
- CVE-2024-30300 · CVE Program
- CVE-2024-30300 · NVD
- FIRST EPSS
- GHSA-m388-cvx4-q52g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences