« Volver al listado

CVE-2024-22590

Estado: AplazadaCrítica (9.1)—

The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kwik — KwikAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22590",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22590",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-22T19:51:23.202156Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ptrd:kwik:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ptrd",
          "product": "kwik",
          "versions": [
            {
              "status": "affected",
              "version": "745fd4e2d8d104b9cf1e8342d150ff8967c65892",
              "lessThan": "11862d54d72de63abd0b76ca6bb9df56e634212c",
              "versionType": "git"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-28T16:15:12.573",
  "references": [
    {
      "url": "https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-372"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established."
    },
    {
      "lang": "es",
      "value": "El motor TLS en Kwik commit 745fd4e2 no rastrea el estado actual de la conexión. Esta vulnerabilidad puede permitir que los mensajes de saludo del cliente se sobrescriban en cualquier momento, incluso después de que se haya establecido una conexión."
    }
  ],
  "lastModified": "2026-06-17T07:11:35.080",
  "sourceIdentifier": "cve@mitre.org"
}