CVE-2024-12397: Cryostat 4 on RHEL 9 (exact versions not specified); +13 more affected products

Affected technology

Product not specified by the source · 0 to before 5.3.4
Vendor not specified by the source

Cryostat 4 on RHEL 9 · Exact affected versions not specified by the source
Red Hat

HawtIO HawtIO 4.2.0 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Quarkus 3.15.3 · Exact affected versions not specified by the source
Red Hat

Cryostat 3 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Apache Camel 4 for Quarkus 3 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Apicurio Registry 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Build of Keycloak · Exact affected versions not specified by the source
Red Hat

Red Hat build of OptaPlanner 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Fuse 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Integration Camel K 1 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Red Hat Process Automation 7 · Exact affected versions not specified by the source
Red Hat

streams for Apache Kafka · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. Vendor/CNA’s CVSS 3.1 assessment (base score 7.4/10) rates confidentiality and integrity impact as high; availability impact as none.