CVE-2024-5552

CVSS V2 None CVSS V3 None

Description

kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.

Overview

CVE ID
CVE-2024-5552

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-06-06T18:09:09.149Z

Last Modified Date
2024-06-10T13:47:50.007Z

Weakness Enumerations

CWE	URL
CWE-1333	http://cwe.mitre.org/data/definitions/1333.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/0c1d6432-f385-4c54-beea-9f8c677def5b

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-5552
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5552

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 03:23:33				Added to TrackCVE