CVE-2024-9798 The health endpoint is public so everybody can see a list of all services

Description

The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.

Affected products and versions

Product	Affected versions	Fixed in
Zowe 2.0	2.0.0 → < 2.18.0	2.18.0
Zowe 1.0	1.0.0 → < 1.28.8	1.28.8
zowe_api_mediation_layer 2.0	2.0.0 → < 2.18.0	2.18.0
zowe_api_mediation_layer 1.0	1.0.0 → < 1.28.8	1.28.8

Other CVEs of Zowe

The 6 CVEs of Zowe →

CVE-2024-9802 The conformance validation endpoint is public so everybody can verify the conformance of onboarded services 5.3 Medium CVE-2024-6834 A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by… 9.0 Critical CVE-2024-6833 A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a… 5.9 Medium CVE-2021-4326 A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands… 3.3 Low