CVE-2024-32007 Security Details

CVE ID

CVE-2024-32007

CWE

CWE-20

CWE-400

NVD-CWE-noinfo

CVE Description

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

Published

Jul 19, 2024

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.258%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/cxf/rs/security/jose/jwe/PbesHmacAesWrapKeyDecryptionAlgorithm.getDecryptedContentEncryptionKey(Lorg/apache/cxf/rs/security/jose/jwe/JweDecryptionInput;)[B

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT