Quick answers
- Is CVE-2024-7953 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-7953 being exploited in the wild.
- How severe is CVE-2024-7953?
- Informational severity, with a CVSS score of 8.8, published 1 September 2026.
- Which products and versions are affected?
- Rockwell Automation DataMosaix Private Cloud ≤7.07.
- Is there a fix for CVE-2024-7953?
- A patch was published on 2024-10-04: Corrected in version 7.09 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-7953 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2024-7953?
- Check whether you run Rockwell Automation DataMosaix Private Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2024-7953 is a missing authorization vulnerability in DataMosaix Private Cloud versions ≤7.07 that allows an authenticated user to escalate privileges and create projects with administrator access. The vulnerability requires low privileges (PR:L) and network reachability but no user interaction. An attacker can leverage improper access controls to create, modify, and delete projects, including those belonging to other users. The issue is corrected in version 7.09. This is one of three related authorization flaws affecting the same product alongside CVE-2024-7952 (unauthenticated data exposure) and CVE-2024-7956 (project access bypass).
Affected products
- Rockwell Automation DataMosaix Private Cloud ≤7.07
Timeline
- 2024-10-04: disclosed
- 2024-10-04: patched: Corrected in version 7.09