CVE-2024-7010

Katalog CVE

CVSS 5.9 · Medium EPSS 0,52%

Kerentanan Observable Timing Discrepancy pada mudler localai. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.

Rincian

Terbit di NVD

29 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mudler/localai/commit/db1159b6511e8fa09e594f9db0fec6ab4e142468 patch
• https://huntr.com/bounties/e286ed00-6383-47de-b5bc-9b9fad67c362 exploit · advisory pihak ketiga