CVE-2024-45692 - Vulnerability Details - OpenCVE

Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00083.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Virtualmin	Virtualmin
Webmin	Webmin

Configuration 1 [-]

OR	cpe:2.3:a:virtualmin:virtualmin::::::::
	cpe:2.3:a:webmin:webmin::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cispa.de/en/loop-dos
https://webmin.com
https://www.openwall.com/lists/oss-security/2024/09/04/1

History

Thu, 05 Sep 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Virtualmin Virtualmin virtualmin Webmin Webmin webmin
Weaknesses		CWE-835
CPEs		cpe:2.3:a:virtualmin:virtualmin:::::::: cpe:2.3:a:webmin:webmin::::::::
Vendors & Products		Virtualmin Virtualmin virtualmin Webmin Webmin webmin
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 04 Sep 2024 23:15:00 +0000

Type	Values Removed	Values Added
Description		Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.
References		https://cispa.de/en/loop-dos https://webmin.com https://www.openwall.com/lists/oss-security/2024/09/04/1

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-09-04T00:00:00

Updated: 2024-09-05T13:43:51.165Z

Reserved: 2024-09-04T00:00:00

Link: CVE-2024-45692

Vulnrichment

Updated: 2024-09-05T13:39:51.458Z

NVD

Status : Analyzed

Published: 2024-09-04T23:15:12.887

Modified: 2024-09-05T21:35:14.337

Link: CVE-2024-45692

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-45692", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-05T13:43:51.165Z", "dateReserved": "2024-09-04T00:00:00", "datePublished": "2024-09-04T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-09-04T23:11:49.503438"}, "descriptions": [{"lang": "en", "value": "Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://cispa.de/en/loop-dos"}, {"url": "https://webmin.com"}, {"url": "https://www.openwall.com/lists/oss-security/2024/09/04/1"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-835", "lang": "en", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "affected": [{"vendor": "webmin", "product": "webmin", "cpes": ["cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.202", "versionType": "custom"}]}, {"vendor": "virtualmin", "product": "virtualmin", "cpes": ["cpe:2.3:a:virtualmin:virtualmin:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.20.2", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T13:39:24.498078Z", "id": "CVE-2024-45692", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T13:43:51.165Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45692", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T13:39:24.498078Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*"], "vendor": "webmin", "product": "webmin", "versions": [{"status": "affected", "version": "0", "lessThan": "2.202", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:virtualmin:virtualmin:*:*:*:*:*:*:*:*"], "vendor": "virtualmin", "product": "virtualmin", "versions": [{"status": "affected", "version": "0", "lessThan": "7.20.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T13:39:51.458Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://cispa.de/en/loop-dos"}, {"url": "https://webmin.com"}, {"url": "https://www.openwall.com/lists/oss-security/2024/09/04/1"}], "descriptions": [{"lang": "en", "value": "Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-09-04T23:11:49.503438"}}}, "cveMetadata": {"cveId": "CVE-2024-45692", "state": "PUBLISHED", "dateUpdated": "2024-09-05T13:43:51.165Z", "dateReserved": "2024-09-04T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-09-04T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:virtualmin:virtualmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "A24DE54E-A013-48BE-BCEE-2BA5B787935F", "versionEndExcluding": "7.20.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "514CA70F-98FB-4640-A7CD-EFB0EF9D9C7A", "versionEndExcluding": "2.202", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000."}, {"lang": "es", "value": "Webmin anterior a 2.202 y Virtualmin anterior a 7.20.2 permiten un bucle de tr\u00e1fico de red a trav\u00e9s de paquetes UDP falsificados en el puerto 10000."}], "id": "CVE-2024-45692", "lastModified": "2024-09-05T21:35:14.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-04T23:15:12.887", "references": [{"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "https://cispa.de/en/loop-dos"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://webmin.com"}, {"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "https://www.openwall.com/lists/oss-security/2024/09/04/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-835"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}