How severe is CVE-2024-6326?

This vulnerability has a severity rating of LOW with a CVSS score of 5.5 out of 10.

What type of vulnerability is CVE-2024-6326?

This is classified as CWE-269, which is a common weakness in software security.

CVE-2024-6326 - LOW Severity | CVSS 5.5

Vulnerability Description

An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.

Related Vulnerabilities

CVE-2014-1496

MEDIUM

CVSS:5.5(Medium)

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during ...

CWE-2692014

CVE-2015-9267

MEDIUM

CVSS:5.5(Medium)

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the...

CWE-2692015

CVE-2017-10689

MEDIUM

CVSS:5.5(Medium)

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

CWE-2692017

CVE-2017-11747

MEDIUM

CVSS:5.5(Medium)

main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveragi...

CWE-2692017

CVE-2017-5409

MEDIUM

CVSS:5.5(Medium)

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which ...

CWE-2692017

CVE-2017-7767

MEDIUM

CVSS:5.5(Medium)

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileg...

CWE-2692017