CVE-2024-23826

CVSS 3.1 Score 5.7 of 10 (medium)

Details

Published Jan 29, 2024
Updated: Feb 8, 2024
CWE ID 770

Summary

CVE-2024-23826 is a vulnerability that affects the spbu_se_site website of the Department of System Programming of St. Petersburg State University. The vulnerability was present before 2024.01.29 and allowed an authenticated user to upload an avatar image with a large Unicode filename, causing a server-side denial of service on Windows operating systems. The issue arose due to the lack of limitations on filename length and the costly use of Unicode normalization with the form NFKD. The vulnerability was addressed in the release on 2024.01.29, mitigating the risk of exploitation. The National Vulnerability Database rates this vulnerability as medium severity with a base score of 5.7 out of 10 and an exploitability score of 2.1 out of 10, highlighting low privileges required for exploitation and network-based attack vector.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23826 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options