CVE-2024-50305
Improper Input Validation (CWE-20)
Published: Nov 14, 2024 / Updated: 5d ago
010
CVSS 7.5EPSS 0.04%High
CVE info copied to clipboard
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
CVE Assignment
NVD published the first details for CVE-2024-50305
Nov 14, 2024 at 10:15 AM
First Article
Feedly found the first article mentioning CVE-2024-50305. See article
Nov 14, 2024 at 10:24 AM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Nov 14, 2024 at 10:24 AM
CVSS
A CVSS base score of 7.5 has been assigned.
Nov 14, 2024 at 7:40 PM / nvd
EPSS
EPSS Score was set to: 0.04% (Percentile: 10.2%)
Nov 15, 2024 at 10:23 AM
Affected Systems
Apache/traffic_server
+null more
Links to Mitre Att&cks
T1562.003: Impair Command History Logging
+null more
Attack Patterns
CAPEC-10: Buffer Overflow via Environment Variables
+null more
News
Apache Traffic Server Patches Critical Vulnerabilities in Latest Release
The Apache Software Foundation has released a security update for Apache Traffic Server, addressing three critical vulnerabilities that could leave users susceptible to a range of cyberattacks. The flaws, impacting versions 9.0.0 to 9.2.5 and 10.0.0 to 10.0.1, range from cache poisoning to potential privilege escalation.
CVE-2024-50305 - Exploits & Severity - Feedly
Feedly found the first article mentioning CVE-2024-50305. See article. Nov 14, 2024 at 2:24 AM / National Vulnerability Database. CVSS Estimate.
Multiple vulnerabilities in Apache Traffic Server
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability. A remote attacker can send specially crafted input to the application and perform a cache poisoning attack.
NA - CVE-2024-50305 - Valid Host header field can cause Apache...
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version...
CVE-2024-50305
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the...
See 7 more articles and social media posts