CVE-2024-23826

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d	Patch
https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:se.math.spbu:spbu_se_site:*:*:*:*:*:*:*:*

History

08 Feb 2024, 16:43

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.7
First Time		Se.math.spbu spbu Se Site Se.math.spbu
References	~~() https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d -~~	() https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d - Patch
References	~~() https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm -~~	() https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm - Exploit, Third Party Advisory
CPE		cpe:2.3:a:se.math.spbu:spbu_se_site::::::::

29 Jan 2024, 16:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-29 16:15

Updated : 2024-02-28 20:54

NVD link : CVE-2024-23826

Mitre link : CVE-2024-23826

CVE.ORG link : CVE-2024-23826

JSON object : View

Products Affected

se.math.spbu

spbu_se_site

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2024-23826", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.1}]}, "published": "2024-01-29T16:15:09.640", "references": [{"url": "https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release."}, {"lang": "es", "value": "spbu_se_site es el sitio web del Departamento de Programaci\u00f3n de Sistemas de la Universidad Estatal de San Petersburgo. Antes del 29/01/2024, al cargar una imagen de avatar, un usuario autenticado puede utilizar intencionalmente un nombre de archivo Unicode grande, lo que provocar\u00eda una denegaci\u00f3n de servicio del lado del servidor en Windows. Esto se debe a la falta de limitaci\u00f3n de la longitud del nombre del archivo y al costoso uso de la normalizaci\u00f3n Unicode con el formato NFKD en el sistema operativo Windows. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 2024.01.29."}], "lastModified": "2024-02-08T16:43:13.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:se.math.spbu:spbu_se_site:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FF8CD3A-E3DF-4A93-BE6F-8057AD60ED84", "versionEndExcluding": "2024.01.29"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}