CVE-2024-45863 - Vulnerability Details - OpenCVE

A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Facebook	Thrift

No data.

No data.

References

Link	Providers
https://www.facebook.com/security/advisories/cve-2024-45863

History

Fri, 27 Sep 2024 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Facebook Facebook thrift
CPEs		cpe:2.3:a:facebook:thrift::::::::
Vendors & Products		Facebook Facebook thrift
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Sep 2024 14:00:00 +0000

Type	Values Removed	Values Added
Description		A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
References		https://www.facebook.com/security/advisories/cve-2024-45863

MITRE

Status: PUBLISHED

Assigner: facebook

Published: 2024-09-27T13:50:29.254Z

Updated: 2024-09-27T14:29:01.158Z

Reserved: 2024-09-10T18:21:24.359Z

Link: CVE-2024-45863

Vulnrichment

Updated: 2024-09-27T14:28:18.687Z

NVD

Status : Awaiting Analysis

Published: 2024-09-27T14:15:04.567

Modified: 2024-09-30T12:45:57.823

Link: CVE-2024-45863

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45863", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "facebook", "dateReserved": "2024-09-10T18:21:24.359Z", "datePublished": "2024-09-27T13:50:29.254Z", "dateUpdated": "2024-09-27T14:29:01.158Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Facebook Thrift", "vendor": "Facebook", "versions": [{"lessThan": "v2024.09.23.00", "status": "affected", "version": "v2024.09.09.00", "versionType": "semver"}]}], "dateAssigned": "2024-09-10T00:00:00", "descriptions": [{"lang": "en", "value": "A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00."}], "problemTypes": [{"descriptions": [{"description": "NULL Pointer Dereference (CWE-476)", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook", "dateUpdated": "2024-09-27T13:50:29.254Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2024-45863"}]}, "adp": [{"affected": [{"vendor": "facebook", "product": "thrift", "cpes": ["cpe:2.3:a:facebook:thrift:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2024.09.09.00", "status": "affected", "lessThan": "2024.09.23.00", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-27T14:28:57.801474Z", "id": "CVE-2024-45863", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T14:29:01.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-27T14:28:57.801474Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:facebook:thrift:*:*:*:*:*:*:*:*"], "vendor": "facebook", "product": "thrift", "versions": [{"status": "affected", "version": "2024.09.09.00", "lessThan": "2024.09.23.00", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T14:28:18.687Z"}}], "cna": {"affected": [{"vendor": "Facebook", "product": "Facebook Thrift", "versions": [{"status": "affected", "version": "v2024.09.09.00", "lessThan": "v2024.09.23.00", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.facebook.com/security/advisories/cve-2024-45863", "tags": ["x_refsource_CONFIRM"]}], "dateAssigned": "2024-09-10T00:00:00", "descriptions": [{"lang": "en", "value": "A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "NULL Pointer Dereference (CWE-476)"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook", "dateUpdated": "2024-09-27T13:50:29.254Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45863", "state": "PUBLISHED", "dateUpdated": "2024-09-27T14:29:01.158Z", "dateReserved": "2024-09-10T18:21:24.359Z", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "datePublished": "2024-09-27T13:50:29.254Z", "assignerShortName": "facebook"}, "dataVersion": "5.1"}