CVE-2024-23826
CVSS 3.1 Score 5.7 of 10 (medium)
Details
Summary
CVE-2024-23826 is a vulnerability that affects the spbu_se_site website of the Department of System Programming of St. Petersburg State University. The vulnerability was present before 2024.01.29 and allowed an authenticated user to upload an avatar image with a large Unicode filename, causing a server-side denial of service on Windows operating systems. The issue arose due to the lack of limitations on filename length and the costly use of Unicode normalization with the form NFKD. The vulnerability was addressed in the release on 2024.01.29, mitigating the risk of exploitation. The National Vulnerability Database rates this vulnerability as medium severity with a base score of 5.7 out of 10 and an exploitability score of 2.1 out of 10, highlighting low privileges required for exploitation and network-based attack vector.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions