Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2024-23638 | First vendor Publication | 2024-01-24 |
| Vendor | Cve | Last vendor Modification | 2024-04-25 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | |||
|---|---|---|---|
| Overall CVSS Score | 6.5 | ||
| Base Score | 6.5 | Environmental Score | 6.5 |
| impact SubScore | 3.6 | Temporal Score | 6.5 |
| Exploitabality Sub Score | 2.8 | ||
| Attack Vector | Network | Attack Complexity | Low |
| Privileges Required | Low | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | None |
| Integrity Impact | None | Availability Impact | High |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : | |||
|---|---|---|---|
| Cvss Base Score | N/A | Attack Range | N/A |
| Cvss Impact Score | N/A | Attack Complexity | N/A |
| Cvss Expoit Score | N/A | Authentication | N/A |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-672 | Operation on a Resource after Expiration or Release |
CPE : Common Platform Enumeration
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-04-25 13:27:32 |
|
| 2024-02-08 13:27:40 |
|
| 2024-02-01 21:27:43 |
|
| 2024-02-01 17:26:44 |
|
| 2024-02-01 13:27:29 |
|
| 2024-02-01 12:31:54 |
|
| 2024-01-31 05:27:24 |
|
| 2024-01-25 02:39:41 |
|
| 2024-01-25 02:39:40 |
|
| 2024-01-24 17:27:23 |
|
| 2024-01-24 05:27:23 |
|
