CVE-2024-56200

{"id": "CVE-2024-56200", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2024-12-19T19:15:08.280", "references": [{"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600", "source": "security-advisories@github.com"}, {"url": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8", "source": "security-advisories@github.com"}, {"url": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Altair es una bifurcaci\u00f3n de Misskey v12. La falta de validaci\u00f3n de solicitudes y de autenticaci\u00f3n en el proxy de im\u00e1genes para comprimir y redimensionar archivos remotos en las versiones afectadas podr\u00eda permitir ataques que podr\u00edan afectar la disponibilidad, como por ejemplo, aumentando de forma anormal el uso de CPU del servidor en el que se ejecuta este software o colocando una carga pesada en la red que est\u00e1 utilizando. Este problema se ha solucionado en v12.24Q4.1. Se recomienda a los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}