« Volver al listado

CVE-2024-51480

Estado: AplazadaAlta (7)—

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI requiere acceso local con privilegios: escalada T1068. Integer overflow + heap overflow permite RCE (T1059). DoS potencial por corrupción de memoria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Redis — RedistimeseriesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-51480",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-51480",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-08T15:43:57.225963Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "RedisTimeSeries",
          "product": "RedisTimeSeries",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.6.20"
            },
            {
              "status": "affected",
              "version": ">= 1.8.0, < 1.8.15"
            },
            {
              "status": "affected",
              "version": ">= 1.10.0, < 1.10.15"
            },
            {
              "status": "affected",
              "version": ">= 1.12.0, < 1.12.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-08T16:15:34.993",
  "references": [
    {
      "url": "https://github.com/RedisTimeSeries/RedisTimeSeries/security/advisories/GHSA-73x6-fqww-x8rg",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3."
    },
    {
      "lang": "es",
      "value": "RedisTimeSeries es un módulo de base de datos de series temporales (TSDB) para Redis, creado por Redis. La ejecución de uno de estos comandos TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE por parte de un usuario autenticado, utilizando argumentos de comando especialmente manipulados, puede provocar un desbordamiento de enteros, un desbordamiento de montón posterior y, potencialmente, provocar la ejecución remota de código. Esta vulnerabilidad se ha corregido en las versiones 1.6.20, 1.8.15, 1.10.15 y 1.12.3."
    }
  ],
  "lastModified": "2026-06-17T08:05:46.527",
  "sourceIdentifier": "security-advisories@github.com"
}