CVE-2024-4227 - Vulnerability Details - OpenCVE

In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Genivia	Gsoap

No data.

No data.

References

Link	Providers
https://sourceforge.net/p/gsoap2/code/HEAD/tree/changelog.md
https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code

History

Wed, 15 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 15 Jan 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.
Title		gSOAP: Vulnerable to specially crafted unencrypted SDC messages
Weaknesses		CWE-834
References		https://sourceforge.net/p/gsoap2/code/HEAD/tree/changelog.md https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-01-15T08:00:24.578Z

Updated: 2025-01-15T14:46:00.530Z

Reserved: 2024-04-26T07:33:57.818Z

Link: CVE-2024-4227

Vulnrichment

Updated: 2025-01-15T14:45:55.933Z

NVD

Status : Received

Published: 2025-01-15T08:15:25.983

Modified: 2025-01-15T08:15:25.983

Link: CVE-2024-4227

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4227", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2024-04-26T07:33:57.818Z", "datePublished": "2025-01-15T08:00:24.578Z", "dateUpdated": "2025-01-15T14:46:00.530Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "gSOAP", "vendor": "Genivia", "versions": [{"lessThanOrEqual": "2.8.132", "status": "affected", "version": "2.8.24", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.<br>"}], "value": "In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-834", "description": "CWE-834 Excessive Iteration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-01-15T08:00:24.578Z"}, "references": [{"tags": ["release-notes"], "url": "https://sourceforge.net/p/gsoap2/code/HEAD/tree/changelog.md"}, {"tags": ["vendor-advisory"], "url": "https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code"}], "source": {"advisory": "VDE-2024-025", "defect": ["CERT@VDE#64665"], "discovery": "UNKNOWN"}, "title": "gSOAP: Vulnerable to specially crafted unencrypted SDC messages", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-15T14:45:48.015327Z", "id": "CVE-2024-4227", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T14:46:00.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-15T14:45:48.015327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T14:45:55.933Z"}}], "cna": {"title": "gSOAP: Vulnerable to specially crafted unencrypted SDC messages", "source": {"defect": ["CERT@VDE#64665"], "advisory": "VDE-2024-025", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Genivia", "product": "gSOAP", "versions": [{"status": "affected", "version": "2.8.24", "versionType": "semver", "lessThanOrEqual": "2.8.132"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://sourceforge.net/p/gsoap2/code/HEAD/tree/changelog.md", "tags": ["release-notes"]}, {"url": "https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.", "supportingMedia": [{"type": "text/html", "value": "In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-834", "description": "CWE-834 Excessive Iteration"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-01-15T08:00:24.578Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4227", "state": "PUBLISHED", "dateUpdated": "2025-01-15T14:46:00.530Z", "dateReserved": "2024-04-26T07:33:57.818Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-01-15T08:00:24.578Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}