CVE-2024-0241

Опубликовано: 04 янв. 2024

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter.

Ссылки

https://github.com/advisories/GHSA-3px7-jm2p-6h2c
Exploit
Third Party Advisory
https://github.com/stevegeek/encoded_id-rails/commit/afa495a77b8a21ad582611f9cdc2081dc4018b91
Patch
https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c
Exploit
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-3px7-jm2p-6h2c
Third Party Advisory
https://github.com/advisories/GHSA-3px7-jm2p-6h2c
Exploit
Third Party Advisory
https://github.com/stevegeek/encoded_id-rails/commit/afa495a77b8a21ad582611f9cdc2081dc4018b91
Patch
https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c
Exploit
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-3px7-jm2p-6h2c
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:diaconou:encodedid\:\:rails:*:*:*:*:*:ruby:*:*

Версия до 1.0.0 (исключая)

cpe:2.3:a:diaconou:encodedid\:\:rails:1.0.0:-:*:*:*:ruby:*:*

cpe:2.3:a:diaconou:encodedid\:\:rails:1.0.0:beta1:*:*:*:ruby:*:*

EPSS

Процентиль: 59%

0.00376

Низкий

7.5 High

CVSS3

Дефекты

CWE-400

CWE-770

Связанные уязвимости

GHSA-3px7-jm2p-6h2c