Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

Customers

Vulnerability IntelligenceCVE-2024-47554

CVE-2024-47554

MEDIUM4.3

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Published Oct 3, 2024

Modified 1 years ago

Details

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2024/10/03/2

ADVISORY

https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1

WEB

https://security.netapp.com/advisory/ntap-20250131-0010/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-47554

CVSS Analysis

CVSS v3.1

4.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness Type (CWE)

Resource Management

CWE-400

Resource Exhaustion

Ecosystems

Timeline

PublishedOct 3, 2024

ModifiedJan 31, 2025

CVE-2024-47554 | Mondoo Vulnerability Intelligence