Уязвимость обхода аутентификации в процессе входа в SmartConsole Check Point позволяет неаутентифицированному удаленному злоумышленнику получить токен входа в приложение и использовать его для аутентификации с полными административными привилегиями. Успешная эксплуатация позволяет злоумышленнику изменять политику безопасности и конфигурации безопасности. Для удаленной эксплуатации требуется доступ к IP-адресу сервера управления через Интернет и конфигурация, не ограничивающая доверенных клиентов.
Check Point знает, что эта уязвимость используется и затронула очень небольшое количество клиентов.
Показать оригинальное описание (EN)
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Условия для атаки
Не требуются
Нет дополнительных условий
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Высокое
Полная утечка данных
Целостность
Высокое
Полная модификация данных
Доступность
Высокое
Полный отказ в обслуживании
Строка CVSS v4.0
Тип уязвимости (CWE)
Уязвимые продукты 122
| Конфигурация | От (включительно) | До (исключительно) |
|---|---|---|
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:*
|
r77.30
|
r81.20
|
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_101:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_105:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_111:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_113:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_115:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_118:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_119:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_120:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_122:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_126:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_127:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_141:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_146:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_24:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_26:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_38:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_45:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_53:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_54:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_65:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_70:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_76:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_79:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_8:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_84:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_89:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_90:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_92:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_96:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_98:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_99:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_107:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_12:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_18:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_25:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_33:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_34:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_36:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_39:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_44:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_60:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_73:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_91:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_24:*:*:*:*:*:*
|
— | — |
|
Checkpoint Multi-Domain_Security_Management
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_6:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:*
|
r77.30
|
r81.20
|
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_101:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_105:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_111:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_113:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_115:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_118:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_119:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_120:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_122:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_126:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_127:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_141:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_146:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_24:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_26:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_38:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_45:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_53:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_54:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_65:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_70:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_76:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_79:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_8:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_84:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_89:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_90:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_92:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_96:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_98:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_99:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_107:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_12:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_18:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_25:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_33:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_34:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_36:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_39:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_44:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_60:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_73:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_91:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_24:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Security_Management
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_6:*:*:*:*:*:*
|
— | — |