CVE-2024-3019
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2024-3019 is a newly discovered vulnerability in PCP (Performance Co-Pilot) that allows remote command execution on Redis server backends due to the default pmproxy configuration. This issue exposes the Redis server to the local network, potentially enabling unauthorized access when pmproxy is running. The pmproxy service is usually started from the Cockpit web interface and is not enabled by default in newer versions of PCP, including version 4.3.4 and later. Users are advised to ensure pmproxy is not running unless necessary, or implement appropriate security measures to mitigate the risk of exploitation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions