CVE-2024-45412

Katalog CVE

CVSS 7.5 · High EPSS 0,78%

Kerentanan Allocation of Resources Without Limits or Throttling pada yeti-platform yeti. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.

Rincian

Terbit di NVD

10 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxv advisory vendor
• https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39 patch
• https://hackerone.com/reports/2258758 exploit · issue tracking · advisory pihak ketiga