CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.6 | $0-$5k | 0.07 |
A vulnerability classified as critical has been found in F5 NGINX Plus and NGINX Open Source (Web Server) (unknown version). This affects an unknown code block of the component QUIC Module. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on availability. The summary by CVE is:
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
The weakness was released 02/14/2024 as K000138445. The advisory is shared at my.f5.com. This vulnerability is uniquely identified as CVE-2024-24990 since 02/02/2024. Neither technical details nor an exploit are publicly available.
Upgrading eliminates this vulnerability.
Entry connected to this vulnerability is available at VDB-253875.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.7VulDB Meta Temp Score: 6.6
VulDB Base Score: 5.9
VulDB Temp Score: 5.7
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 7.5
CNA Vector (F5 Networks): 🔒
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Use after freeCWE: CWE-416 / CWE-119
CAPEC: 🔒
ATT&CK: 🔒
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Timeline
02/02/2024 CVE reserved02/14/2024 Advisory disclosed
02/14/2024 VulDB entry created
02/15/2024 VulDB entry last update
Sources
Vendor: f5.comAdvisory: K000138445
Status: Confirmed
CVE: CVE-2024-24990 (🔒)
See also: 🔒
Entry
Created: 02/14/2024 19:20Updated: 02/15/2024 11:10
Changes: 02/14/2024 19:20 (50), 02/15/2024 11:10 (1)
Complete: 🔍
Cache ID: 13:32A:103
could you please align to the official NVD NIST cpe "f5:nginx"? There is no cpe "f5:nginx_open_source", F5 NGINX Open Source and F5 Nginx Server are the same thing. These are two different names for the same product, the free and open source web server based on the NGINX project.
We would appreciate it very much.
Best Regards,
TEAM CERT
Want to stay up to date on a daily basis?
Enable the mail alert feature now!