CVE-2024-5552

{"id": "CVE-2024-5552", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:16:09.697", "references": [{"url": "https://huntr.com/bounties/0c1d6432-f385-4c54-beea-9f8c677def5b", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption."}, {"lang": "es", "value": "kubeflow/kubeflow es vulnerable a un ataque de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) debido a la complejidad ineficiente de la expresi\u00f3n regular en su mecanismo de validaci\u00f3n de correo electr\u00f3nico. Un atacante puede explotar esta vulnerabilidad de forma remota sin autenticaci\u00f3n proporcionando una entrada especialmente manipulada que hace que la aplicaci\u00f3n consuma una cantidad excesiva de recursos de CPU. Esta vulnerabilidad afecta a la \u00faltima versi\u00f3n de kubeflow/kubeflow, espec\u00edficamente dentro del componente backend centraldashboard-angular. El impacto de explotar esta vulnerabilidad incluye el agotamiento de los recursos y la interrupci\u00f3n del servicio."}], "lastModified": "2024-09-23T22:31:27.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubeflow:kubeflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54178209-DB65-4403-BD9F-233459884AF5", "versionEndExcluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}