{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9953", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2024-10-14T20:49:18.194Z", "datePublished": "2024-10-14T21:19:26.517Z", "dateUpdated": "2024-10-15T15:41:26.375Z"}, "containers": {"cna": {"title": "Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8", "descriptions": [{"lang": "en", "value": "A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user\u2019s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations."}], "affected": [{"vendor": "CERT/CC", "product": "VINCE - Vulnerability Information and Coordination Environment", "defaultStatus": "unaffected", "versions": [{"version": "*", "status": "affected", "lessThan": "3.0.8", "versionType": "custom"}]}], "references": [{"url": "https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity", "name": "CERT/CC GitHub Issues"}], "credits": [{"lang": "en", "value": "Thanks to security researcher @coldwaterhq (https://github.com/coldwaterhq) for reporting this vulnerability and adhering to the responsible disclosure process."}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "cweId": "CWE-502"}]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cveClient/1.0.15"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-10-15T15:14:26.539Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T15:41:05.626356Z", "id": "CVE-2024-9953", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T15:41:26.375Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T15:41:05.626356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T15:41:19.123Z"}}], "cna": {"title": "Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Thanks to security researcher @coldwaterhq (https://github.com/coldwaterhq) for reporting this vulnerability and adhering to the responsible disclosure process."}], "affected": [{"vendor": "CERT/CC", "product": "VINCE - Vulnerability Information and Coordination Environment", "versions": [{"status": "affected", "version": "*", "lessThan": "3.0.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity", "name": "CERT/CC GitHub Issues"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user\u2019s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-10-15T15:14:26.539Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9953", "state": "PUBLISHED", "dateUpdated": "2024-10-15T15:41:26.375Z", "dateReserved": "2024-10-14T20:49:18.194Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2024-10-14T21:19:26.517Z", "assignerShortName": "certcc"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C544DF4-D81C-4B8B-BF53-36E89EE2D4AA", "versionEndExcluding": "3.0.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user\u2019s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations."}, {"lang": "es", "value": "Existe una vulnerabilidad de denegaci\u00f3n de servicio potencial en el software CERT VINCE anterior a la versi\u00f3n 3.0.8. Un usuario administrativo autenticado puede inyectar un objeto pickle arbitrario como parte del perfil de un usuario. Esto puede provocar una posible denegaci\u00f3n de servicio en el servidor cuando se accede al perfil del usuario. El servidor Django impide que la desinstalaci\u00f3n del pickle haga que el servidor se bloquee."}], "id": "CVE-2024-9953", "lastModified": "2024-10-17T20:59:01.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-10-14T22:15:03.957", "references": [{"source": "cret@cert.org", "tags": ["Patch"], "url": "https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "cret@cert.org", "type": "Secondary"}]}

{}