« Volver al listado

CVE-2024-34084

Estado: AplazadaAlta (7.5)—

Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to `HandleGithubWebhook` to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lfprojects — MinderAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34084",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34084",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-07T18:05:18.956707Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "stacklok",
          "product": "minder",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.0.48"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:stacklok:minder:*:*:*:*:*:*:*:*"
          ],
          "vendor": "stacklok",
          "product": "minder",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.0.48",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-07T15:15:09.540",
  "references": [
    {
      "url": "https://github.com/stacklok/minder/commit/3e5a527d2f1b535159206161d1d519602c75bd0d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-9c5w-9q3f-3hv7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/stacklok/minder/commit/3e5a527d2f1b535159206161d1d519602c75bd0d",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-9c5w-9q3f-3hv7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to `HandleGithubWebhook` to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48."
    },
    {
      "lang": "es",
      "value": "El `HandleGithubWebhook` de Minder es susceptible a un ataque de denegación de servicio procedente de una solicitud HTTP que no es de confianza. La vulnerabilidad existe antes de que se haya validado la solicitud y, como tal, la solicitud aún no es confiable en el momento del error. Esto permite que un atacante con la capacidad de enviar solicitudes a \"HandleGithubWebhook\" bloquee el plano de control de Minder y niegue a otros usuarios su uso. Esta vulnerabilidad se solucionó en 0.0.48."
    }
  ],
  "lastModified": "2026-06-17T07:32:52.450",
  "sourceIdentifier": "security-advisories@github.com"
}