CVE-2024-10344 - Vulnerability Details - OpenCVE

In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Perforce	Helix Core

No data.

No data.

References

Link	Providers
https://portal.perforce.com/s/detail/a91PA000001SZOrYAO

History

Tue, 26 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Perforce Perforce helix Core
CPEs		cpe:2.3:a:perforce:helix_core:-:::::::*
Vendors & Products		Perforce Perforce helix Core
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 Nov 2024 14:30:00 +0000

Type	Values Removed	Values Added
Title	Unauthenticated Denial of Service via Refuse Function in Helix Core	Unauthenticated Denial of Service via Refuse Function

Mon, 11 Nov 2024 14:15:00 +0000

Type	Values Removed	Values Added
Description		In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek.
Title		Unauthenticated Denial of Service via Refuse Function in Helix Core
Weaknesses		CWE-400
References		https://portal.perforce.com/s/detail/a91PA000001SZOrYAO
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2024-11-11T14:08:11.753Z

Updated: 2025-01-29T19:41:20.345Z

Reserved: 2024-10-24T13:48:10.942Z

Link: CVE-2024-10344

Vulnrichment

Updated: 2024-11-11T15:55:49.793Z

NVD

Status : Awaiting Analysis

Published: 2024-11-11T14:15:14.453

Modified: 2024-11-21T08:48:25.887

Link: CVE-2024-10344

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10344", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2024-10-24T13:48:10.942Z", "datePublished": "2024-11-11T14:08:11.753Z", "dateUpdated": "2025-01-29T19:41:20.345Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Helix Core", "vendor": "Helix", "versions": [{"lessThan": "2024.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2024.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2023.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2023.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2022.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified</span><span style=\"background-color: rgb(255, 255, 255);\">. </span><span style=\"background-color: rgb(255, 255, 255);\">Reported by Karol </span><span style=\"background-color: rgb(255, 255, 255);\">Wi\u0119sek</span><span style=\"background-color: rgb(255, 255, 255);\">.</span><br>"}], "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Wi\u0119sek."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-01-29T19:41:20.345Z"}, "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SZOrYAO"}], "source": {"discovery": "UNKNOWN"}, "title": "Unauthenticated Denial of Service via Refuse Function", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "perforce", "product": "helix_core", "cpes": ["cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2024.2", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-11T15:56:00.459087Z", "id": "CVE-2024-10344", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T14:17:54.747Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10344", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-11T15:56:00.459087Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:*"], "vendor": "perforce", "product": "helix_core", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.2", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-11T15:55:49.793Z"}}], "cna": {"title": "Unauthenticated Denial of Service via Refuse Function", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Helix", "product": "Helix Core", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2024.2", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2024.1", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2023.2", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2023.1", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2022.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SZOrYAO"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Wi\u0119sek.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified</span><span style=\"background-color: rgb(255, 255, 255);\">. </span><span style=\"background-color: rgb(255, 255, 255);\">Reported by Karol </span><span style=\"background-color: rgb(255, 255, 255);\">Wi\u0119sek</span><span style=\"background-color: rgb(255, 255, 255);\">.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-01-29T19:41:20.345Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10344", "state": "PUBLISHED", "dateUpdated": "2025-01-29T19:41:20.345Z", "dateReserved": "2024-10-24T13:48:10.942Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2024-11-11T14:08:11.753Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Wi\u0119sek."}, {"lang": "es", "value": "En versiones de Helix Core anteriores a 2024.2, se identific\u00f3 una denegaci\u00f3n de servicio (DoS) remota no autenticada a trav\u00e9s de la funci\u00f3n de rechazo. Informado por Karol Wi?sek."}], "id": "CVE-2024-10344", "lastModified": "2024-11-21T08:48:25.887", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "NONE"}, "source": "security@puppet.com", "type": "Secondary"}]}, "published": "2024-11-11T14:15:14.453", "references": [{"source": "security@puppet.com", "url": "https://portal.perforce.com/s/detail/a91PA000001SZOrYAO"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@puppet.com", "type": "Secondary"}]}