PT-2025-12026 · Aimhubio · Aim

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10110

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0

Description The ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.

Recommendations For aimhubio/aim version 3.23.0, consider restricting the instantiation of the ScheduledStatusReporter object to prevent it from running on the main thread of the tracking server. As a temporary workaround, consider disabling the ScheduledStatusReporter object until a patch is available.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-10110

GHSA-FX47-JPV9-7HXR

Affected Products

Aim

References · 7

• 🔥 https://huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10110 · Security Note
• https://osv.dev/vulnerability/GHSA-fx47-jpv9-7hxr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10110 · Vendor Advisory
• https://github.com/aimhubio/aim · Note
• https://github.com/aimhubio/aim/blob/a566d4a2501c96a545a3c89d92af6ad7e7e0da99/aim/sdk/reporter/__init__.py#L789 · Note
• https://twitter.com/CVEnew/status/1902968909403394277 · Twitter Post