« Volver al listado

CVE-2024-56200

Estado: AplazadaAlta (8.6)—

Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red sin autenticación a proxy de imágenes sin validación (AV:N/PR:N/UI:N); consumo anormal de CPU y carga de red indica DoS de aplicación (T1499).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Altair — AltairAIMisskey — MisskeyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-56200",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-56200",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-20T20:03:37.413091Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nexryai",
          "product": "altair",
          "versions": [
            {
              "status": "affected",
              "version": "< v12.24Q4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-19T19:15:08.280",
  "references": [
    {
      "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Altair es una bifurcación de Misskey v12. La falta de validación de solicitudes y de autenticación en el proxy de imágenes para comprimir y redimensionar archivos remotos en las versiones afectadas podría permitir ataques que podrían afectar la disponibilidad, como por ejemplo, aumentando de forma anormal el uso de CPU del servidor en el que se ejecuta este software o colocando una carga pesada en la red que está utilizando. Este problema se ha solucionado en v12.24Q4.1. Se recomienda a los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T08:11:50.253",
  "sourceIdentifier": "security-advisories@github.com"
}