PT-2024-20923 · Steve · Steve

Tano-Coppoletta · Published 2024-02-12 · Updated 2025-04-25 · CVE-2024-25407

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SteVe version 3.6.0

Description The issue is related to SteVe using predictable transaction ID's when receiving a StartTransaction request. This can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions. The StartTransaction request is the endpoint where this issue is observed.

Recommendations For SteVe version 3.6.0, as a temporary workaround, consider restricting access to the StartTransaction request until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2024-25407

Affected Products

Steve

References · 7

• https://github.com/steve-community/steve/issues/1296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25407 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25407 · Vendor Advisory
• https://twitter.com/CVEnew/status/1757222738979090591 · Twitter Post
• https://t.me/cvenotify/71175 · Telegram Post
• https://t.me/cvenotify/119823 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757297464820871379 · Twitter Post