CVE-2024-56200

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-56200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-12-18T18:29:25.896Z", "datePublished": "2024-12-19T18:43:06.397Z", "dateUpdated": "2024-12-20T20:03:46.784Z"}, "containers": {"cna": {"title": "Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-405", "lang": "en", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv"}, {"name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600", "tags": ["x_refsource_MISC"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600"}, {"name": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8", "tags": ["x_refsource_MISC"], "url": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8"}], "affected": [{"vendor": "nexryai", "product": "altair", "versions": [{"version": "< v12.24Q4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-19T18:43:06.397Z"}, "descriptions": [{"lang": "en", "value": "Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-3pfm-hp96-pfgv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-20T20:03:37.413091Z", "id": "CVE-2024-56200", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-20T20:03:46.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-56200", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-20T20:03:37.413091Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-20T20:03:42.552Z"}}], "cna": {"title": "Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy", "source": {"advisory": "GHSA-3pfm-hp96-pfgv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nexryai", "product": "altair", "versions": [{"status": "affected", "version": "< v12.24Q4.1"}]}], "references": [{"url": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv", "name": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600", "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8", "name": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-19T18:43:06.397Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56200", "state": "PUBLISHED", "dateUpdated": "2024-12-20T20:03:46.784Z", "dateReserved": "2024-12-18T18:29:25.896Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-19T18:43:06.397Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "altair", "vendor": "nexryai", "versions": [{"status": "affected", "version": "< v12.24Q4.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Altair es una bifurcaci\u00f3n de Misskey v12. La falta de validaci\u00f3n de solicitudes y de autenticaci\u00f3n en el proxy de im\u00e1genes para comprimir y redimensionar archivos remotos en las versiones afectadas podr\u00eda permitir ataques que podr\u00edan afectar la disponibilidad, como por ejemplo, aumentando de forma anormal el uso de CPU del servidor en el que se ejecuta este software o colocando una carga pesada en la red que est\u00e1 utilizando. Este problema se ha solucionado en v12.24Q4.1. Se recomienda a los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."}], "id": "CVE-2024-56200", "lastModified": "2026-06-17T08:11:50.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56200", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-20T20:03:37.413091Z", "version": "2.0.3"}}]}, "published": "2024-12-19T19:15:08.280", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600"}, {"source": "security-advisories@github.com", "url": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8"}, {"source": "security-advisories@github.com", "url": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-405"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}