Lucene search

VulDBCVE-2024-8462

HistorySep 05, 2024 - 1:15 p.m.

CVE-2024-8462

2024-09-0513:15:12

CWE-307

VulDB

web.nvd.nist.gov

windmill vulnerability http request handler restriction manipulation remote attack upgrade patch

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

4.5

Confidence

High

EPSS

Percentile

16.3%

JSON

A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component.

Affected configurations

Vulners

Node

windmill_projectwindmillMatch1.380.0

VendorProductVersionCPE
windmill_projectwindmill1.380.0cpe:2.3:a:windmill_project:windmill:1.380.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
windmill_project	windmill	1.380.0	cpe:2.3:a:windmill_project:windmill:1.380.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Windmill",
    "versions": [
      {
        "version": "1.380.0",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP Request Handler"
    ]
  }
]

References

github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3

github.com/windmill-labs/windmill/releases/tag/v1.390.1

vuldb.com/?ctiid.276630

vuldb.com/?id.276630

vuldb.com/?submit.401826

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

4.5

Confidence

High

EPSS

Percentile

16.3%

JSON

Related for CVE-2024-8462