PT-2025-12053 · Hyperlpr · Hyperlpr

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-10713

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions szad670401/hyperlpr version 3.0

Description A Denial of Service (DoS) attack is possible due to the server's inability to handle excessive characters appended to the end of multipart boundaries. This can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service for all users. The issue can be exploited without authentication, meaning no user login or interaction is required.

Recommendations For szad670401/hyperlpr version 3.0, consider restricting access to the server to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the multipart boundary feature in requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-10713

GHSA-CG4P-5QFM-PJJJ

Affected Products

Hyperlpr

References · 6

• https://osv.dev/vulnerability/GHSA-cg4p-5qfm-pjjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10713 · Security Note
• https://github.com/szad670401/hyperlpr · Note
• https://github.com/szad670401/HyperLPR/blob/9307450f7b7915be18f23a539ec05b41fe6629f4/Prj-Python/hyperlpr3/command/serve.py#L95 · Note
• https://huntr.com/bounties/d5404069-95b3-40e0-a7a4-c3a183d861b0 · Note
• https://twitter.com/CVEnew/status/1903336855455797690 · Twitter Post