PT-2024-36737 · Altair · Altair

Published 2024-12-19 · Updated 2024-12-19 · CVE-2024-56200

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Altair versions prior to v12.24Q4.1

Description The issue is related to a lack of validation and authentication in the image proxy for compressing and resizing remote files, which could allow attacks affecting availability. This could result in abnormally increasing the CPU usage of the server or placing a heavy load on the network.

Recommendations For versions prior to v12.24Q4.1, upgrade to v12.24Q4.1 to secure against cyber threats. As a temporary workaround, consider restricting access to the image proxy to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-405

Related Identifiers

CVE-2024-56200

GHSA-3PFM-HP96-PFGV

GHSA-GQ5Q-C77C-V23600

Affected Products

Altair

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56200.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-56200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56200 · Security Note
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600 · Note
• https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv · Note
• https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8 · Note
• https://t.me/cvedetector/13361 · Telegram Post
• https://twitter.com/CVEnew/status/1869817892360904947 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869865216424489042 · Twitter Post
• https://twitter.com/CveFindCom/status/1869820277749670304 · Twitter Post