CVE-2024-3653

{"id": "CVE-2024-3653", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-07-08T22:15:02.527", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:4392", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5143", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5144", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5145", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5147", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:6437", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-3653", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274437", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4392", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-3653", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274437", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240828-0002/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Undertow. Este problema requiere habilitar el controlador de aprendizaje-push en la configuraci\u00f3n del servidor, que est\u00e1 deshabilitado de forma predeterminada, dejando la configuraci\u00f3n maxAge en el controlador sin configurar. El valor predeterminado es -1, lo que hace que el controlador sea vulnerable. Si alguien sobrescribe esa configuraci\u00f3n, el servidor no est\u00e1 sujeto al ataque. El atacante debe poder llegar al servidor con una solicitud HTTP normal."}], "lastModified": "2024-11-21T09:30:06.253", "sourceIdentifier": "secalert@redhat.com"}