Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-32007

Good to know:

icon
icon

Date: July 19, 2024

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

Language: Java

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-32007
https://github.com/apache/cxf
https://github.com/apache/cxf/commit/d1d77c34c199c2c87ebcfe23e3c81dccfe2e2473
https://github.com/apache/cxf/commit/2d2baa3455db7439bf1ed4e00edfc5a7106edf7d
https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633
https://github.com/apache/cxf/commit/20793d3fed2e73e2785a58ec5b47403306ae4a5c
https://www.mend.io/vulnerability-database/CVE-2024-32007

Severity Score

Weakness Type (CWE)

Input Validation

CWE-20

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Top Fix

icon

Upgrade Version

Upgrade to version org.apache.cxf:cxf-rt-rs-security-jose:3.5.9,3.6.4,4.0.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us