PT-2025-12215 · Aimhubio · Aim

Published 2025-03-20 · Updated 2025-07-23 · CVE-2024-8061

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0

Description The application contains methods that request data from external servers without defined timeouts. This can cause the server to wait indefinitely for a response, potentially leading to a denial of service, as the tracking server becomes unresponsive to other requests while awaiting a response. The issue is present in the client used by the aim tracking server to communicate with external resources, specifically within the run read instructions method and similar calls lacking timeouts.

Recommendations aimhubio/aim version 3.23.0: Implement timeouts for all methods that request data from external servers to prevent indefinite waiting and potential denial of service. Specifically, address the run read instructions method and similar calls to ensure they include appropriate timeout mechanisms.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1088

CWE-400

Related Identifiers

CVE-2024-8061

GHSA-6W7P-XRVP-P7XV

Affected Products

Aim

References · 8

• 🔥 https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b · Exploit
• https://osv.dev/vulnerability/CVE-2024-8061 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6w7p-xrvp-p7xv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8061 · Security Note
• https://github.com/aimhubio/aim · Note
• https://github.com/aimhubio/aim/blob/a6c6f2fee0f1abe37c1d66701b0329fb6af31a3d/aim/ext/transport/client.py#L258 · Note
• https://t.me/cveNotify/130051 · Telegram Post
• https://twitter.com/CVEnew/status/1902674356918182296 · Twitter Post