CVE-2024-30915 Denial of service in n/a
A local attacker can cause denial of service and read sensitive information via the max_samples parameter in OpenDDS DataReaderQoS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30915?
CVE-2024-30915 is a medium-severity denial of service vulnerability in n/a, published on 11 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and obtain sensitive information via the max_samples parameter within the DataReaderQoS component.
Weakness: CWE-400
Which versions are affected by CVE-2024-30915?
It affects 1 product.
Products include Objectcomputing Opendds.
How do I fix CVE-2024-30915?
No fix has been published for CVE-2024-30915 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-30915 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30915 exists.
Other vulnerabilities in n/a
- CVE-2021-38447 OCI OpenDDS Secure Amplification
- CVE-2025-67111 Integer overflow in n/a
- CVE-2023-52427 Denial of service in n/a
- CVE-2023-37915 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS
- CVE-2021-38445 OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency
Sources
Also known as GHSA-2g9g-66pp-8rq7.