PT-2024-6627 · Loway · Queuemetrics

Published 2024-09-03 · Updated 2024-09-11 · CVE-2024-42342

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Loway QueueMetrics (affected versions not specified)

Description: The issue is related to inconsistent interpretation of HTTP requests, which can be exploited by a remote attacker to bypass existing security restrictions and perform an HTTP request smuggling attack. This type of attack can allow an attacker to manipulate the HTTP requests and responses, potentially leading to unauthorized access or other malicious activities.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2024-07786

CVE-2024-42342

Affected Products

Queuemetrics

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-42342 · Security Note
• https://bdu.fstec.ru/vul/2024-07786 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42342 · Vendor Advisory
• https://t.me/cvenotify/94214 · Telegram Post
• https://twitter.com/CVEnew/status/1832757537701061042 · Twitter Post
• https://t.me/cvedetector/5080 · Telegram Post
• https://gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 · Note
• https://twitter.com/VulmonFeeds/status/1832788837224894674 · Twitter Post
• https://gov.il/en/Departments/faq/cve_advisories · Note