CVE-2024-38826 MEDIUM

CVE-2024-38826: CVE-2024-38826 Cloud Controller Denial of Service Attack

Vendor Cloud Foundry
Product Cloud Foundry
Published November 11, 2024
Last update March 17, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L

What the vulnerability does

01Description

Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller. The Cloud Foundry project recommends upgrading the following releases: * Upgrade capi release version to 1.194.0 or greater * Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release

Key dates

02Disclosure timeline

November 11, 2024 CVE published
March 17, 2025 Record updated