CVE-2024-10345 - Vulnerability Details - OpenCVE

In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Perforce	Helix Core

No data.

No data.

References

Link	Providers
https://portal.perforce.com/s/detail/a91PA000001SZQTYA4

History

Mon, 11 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Perforce Perforce helix Core
CPEs		cpe:2.3:a:perforce:helix_core:-:::::::*
Vendors & Products		Perforce Perforce helix Core
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 Nov 2024 14:30:00 +0000

Type	Values Removed	Values Added
Title	Unauthenticated Denial of Service via Shutdown Function in Helix Core	Unauthenticated Denial of Service via Shutdown Function

Mon, 11 Nov 2024 13:30:00 +0000

Type	Values Removed	Values Added
Description		In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek.
Title		Unauthenticated Denial of Service via Shutdown Function in Helix Core
Weaknesses		CWE-400
References		https://portal.perforce.com/s/detail/a91PA000001SZQTYA4
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2024-11-11T13:28:09.254Z

Updated: 2025-01-29T19:39:33.787Z

Reserved: 2024-10-24T13:48:12.326Z

Link: CVE-2024-10345

Vulnrichment

Updated: 2024-11-11T14:22:23.783Z

NVD

Status : Awaiting Analysis

Published: 2024-11-11T14:15:14.563

Modified: 2024-11-21T08:48:25.993

Link: CVE-2024-10345

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10345", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2024-10-24T13:48:12.326Z", "datePublished": "2024-11-11T13:28:09.254Z", "dateUpdated": "2025-01-29T19:39:33.787Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Helix Core", "vendor": "Helix", "versions": [{"lessThan": "2024.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2024.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2023.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2023.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2022.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol <span style=\"background-color: var(--clrSpellingErrorHighlightBg,#ffe5e5);\">Wi\u0119sek</span>.</span><span style=\"background-color: rgb(255, 255, 255);\"> </span><br>"}], "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Wi\u0119sek."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-01-29T19:39:33.787Z"}, "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SZQTYA4"}], "source": {"discovery": "UNKNOWN"}, "title": "Unauthenticated Denial of Service via Shutdown Function", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "perforce", "product": "helix_core", "cpes": ["cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2024.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-11T14:22:31.677652Z", "id": "CVE-2024-10345", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-11T14:22:35.955Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10345", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-11T14:22:31.677652Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:*"], "vendor": "perforce", "product": "helix_core", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-11T14:22:23.783Z"}}], "cna": {"title": "Unauthenticated Denial of Service via Shutdown Function", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Helix", "product": "Helix Core", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2024.2", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2024.1", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2023.2", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2023.1", "versionType": "semver"}, {"status": "affected", "version": "0.0.0", "lessThan": "2022.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SZQTYA4"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Wi\u0119sek.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol <span style=\"background-color: var(--clrSpellingErrorHighlightBg,#ffe5e5);\">Wi\u0119sek</span>.</span><span style=\"background-color: rgb(255, 255, 255);\"> </span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-01-29T19:39:33.787Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10345", "state": "PUBLISHED", "dateUpdated": "2025-01-29T19:39:33.787Z", "dateReserved": "2024-10-24T13:48:12.326Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2024-11-11T13:28:09.254Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Wi\u0119sek."}, {"lang": "es", "value": "En versiones de Helix Core anteriores a 2024.2, se identific\u00f3 una denegaci\u00f3n de servicio (DoS) remota no autenticada a trav\u00e9s de la funci\u00f3n de apagado. Informado por Karol Wi?sek."}], "id": "CVE-2024-10345", "lastModified": "2024-11-21T08:48:25.993", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "NONE"}, "source": "security@puppet.com", "type": "Secondary"}]}, "published": "2024-11-11T14:15:14.563", "references": [{"source": "security@puppet.com", "url": "https://portal.perforce.com/s/detail/a91PA000001SZQTYA4"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@puppet.com", "type": "Secondary"}]}