CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
An authenticated admin can inject pickle objects into user profiles, causing denial of service when accessed, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9953?
CVE-2024-9953 is a medium-severity unsafe deserialization vulnerability in CERT/CC VINCE - Vulnerability Information and Coordination Environment, published on 14 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.
Weakness: CWE-502
Which versions are affected by CVE-2024-9953?
It affects 1 product.
Products include Cert Vince.
How do I fix CVE-2024-9953?
No fix has been published for CVE-2024-9953 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-9953 being exploited?
There is no known exploitation of CVE-2024-9953 in the wild and no public exploit code.
Other vulnerabilities in CERT/CC VINCE - Vulnerability Information and Coordination Environment
- CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
- CVE-2022-25799 An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0
- CVE-2022-40248 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
- CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
- CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
Sources
Also known as GHSA-gjpq-5jrr-h6wr.