Information disclosure (checkpoint Check Point Quantum Gateway, Spark Gateway and CloudGuard Network)
At a glance
- Source
- NVD
- EPSS
- EPSS 99.98 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- checkpoint
- NVD status
- Analyzed
Description
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | checkpoint |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | NVD · cve@checkpoint.com (Secondary) |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-22282
- GCVE · GCVE-0-2024-24919
CERT-FR advisories
- CERTFR-2024-AVI-0449 — Vulnérabilité dans les produits Check Point · cert.ssi.gouv.fr
- CERTFR-2024-ALE-008 — [MàJ] Vulnérabilité dans les produits Check Point · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:checkpoint:quantum_spark_firmware:r80.40:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_spark_firmware:r81:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r80.40:*:*:*:*:*:*:*cpe:2.3:a:checkpoint:cloudguard_network_security:r80.40:*:*:*:*:*:*:*cpe:2.3:a:checkpoint:cloudguard_network_security:r81:*:*:*:*:*:*:*cpe:2.3:a:checkpoint:cloudguard_network_security:r81.10:*:*:*:*:*:*:*cpe:2.3:a:checkpoint:cloudguard_network_security:r81.20:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81.20:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81.10:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_spark_firmware:r81.10:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_spark_firmware:r80.20:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| checkpoint · Check Point Quantum Gateway, Spark Gateway and CloudGuard Network | affected Check Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |