CVE-2024-9953

A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-14 22:15

Updated : 2025-03-20 19:15

NVD link : CVE-2024-9953

Mitre link : CVE-2024-9953

CVE.ORG link : CVE-2024-9953

JSON object : View

Products Affected

cert

vince

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-9953", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2024-10-14T22:15:03.957", "references": [{"url": "https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity", "tags": ["Patch"], "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user\u2019s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations."}, {"lang": "es", "value": "Existe una vulnerabilidad de denegaci\u00f3n de servicio potencial en el software CERT VINCE anterior a la versi\u00f3n 3.0.8. Un usuario administrativo autenticado puede inyectar un objeto pickle arbitrario como parte del perfil de un usuario. Esto puede provocar una posible denegaci\u00f3n de servicio en el servidor cuando se accede al perfil del usuario. El servidor Django impide que la desinstalaci\u00f3n del pickle haga que el servidor se bloquee."}], "lastModified": "2025-03-20T19:15:36.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C544DF4-D81C-4B8B-BF53-36E89EE2D4AA", "versionEndExcluding": "3.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}