CVE-2022-24863
Denial of service in http-swagger
Vexday Risk Score
21Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 7.5EPSS 2.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
18 abr 2022Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
swaggo · http-swaggerQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →