CWE-1284
AllowedImproper Validation of Specified Quantity in Input
Abstraction: Base · Status: Incomplete
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
662 vulnerabilities reference this CWE, most recent first.
GHSA-73PW-PFFQ-GH67
Vulnerability from github – Published: 2024-11-27 18:34 – Updated: 2024-11-27 21:32Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2024-9369"
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-27T18:15:18Z",
"severity": "MODERATE"
},
"details": "Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-73pw-pffq-gh67",
"modified": "2024-11-27T21:32:44Z",
"published": "2024-11-27T18:34:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9369"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/368208152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-754J-98WH-57RF
Vulnerability from github – Published: 2026-10-16 19:22 – Updated: 2026-10-16 19:22Summary
Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and query string. Because the rewritten request is still sent as the application's authenticated POST with its Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes.
Details
The flaw is in lib/swoosh/adapters/ms_graph.ex. api_endpoint_url/2 constructs the Graph endpoint by interpolating the email's from address into the path /users/{from}/sendMail. The from value is taken verbatim from the email struct and is neither percent-encoded nor validated against the RFC 5321 character set before being placed into the URL. deliver/2 then issues an authenticated POST to that constructed URL using the application's Graph bearer token.
Because the address sits as the local part of /users/{from}/sendMail, characters such as /, ?, and # are not neutralized. A / lets the attacker append or replace additional path segments, a ? starts an attacker-controlled query string, and # truncates the remainder of the intended path. The result is that the authenticated request can be steered to a different Graph endpoint or carry attacker-chosen query parameters, all under the token's existing scopes. Applications that always send with a fixed, trusted from address never reach the injectable path and are unaffected.
PoC
- Configure an application to use
Swoosh.Adapters.MsGraphand derive the emailfromaddress from user-influenced input (e.g. a contact form's reply address or a "send as" field). - Submit a
fromaddress whose local part contains URL-special characters, for example one using/,?, or#to escape the/users/{from}/sendMailpath segment. - Trigger delivery; Swoosh interpolates the address unencoded and sends the application's authenticated Graph
POSTto the attacker-rewritten path and query string.
Impact
An attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API.
References
- Introduction commit: https://github.com/swoosh/swoosh/commit/23bfcdab71aee4613858ba6d116bb3311b72aa58
- Patch commit: https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61
- Affected adapter source: https://github.com/swoosh/swoosh/blob/master/lib/swoosh/adapters/ms_graph.ex
{
"affected": [
{
"package": {
"ecosystem": "Hex",
"name": "swoosh"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.26.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54893"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-1284",
"CWE-789"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-16T19:22:31Z",
"nvd_published_at": "2026-07-06T15:16:39Z",
"severity": "LOW"
},
"details": "### Summary\n\n`Swoosh.Adapters.MsGraph` builds its Microsoft Graph API request URL by interpolating the sender\u0027s email address directly into the URL path (`/users/{from}/sendMail`) without percent-encoding or validation. In applications that derive the `from` address from untrusted or user-influenced input (a relay, a contact form, or a \"send as\" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request\u0027s path and query string. Because the rewritten request is still sent as the application\u0027s authenticated `POST` with its Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token\u0027s scopes.\n\n### Details\n\nThe flaw is in `lib/swoosh/adapters/ms_graph.ex`. `api_endpoint_url/2` constructs the Graph endpoint by interpolating the email\u0027s `from` address into the path `/users/{from}/sendMail`. The `from` value is taken verbatim from the email struct and is neither percent-encoded nor validated against the RFC 5321 character set before being placed into the URL. `deliver/2` then issues an authenticated `POST` to that constructed URL using the application\u0027s Graph bearer token.\n\nBecause the address sits as the local part of `/users/{from}/sendMail`, characters such as `/`, `?`, and `#` are not neutralized. A `/` lets the attacker append or replace additional path segments, a `?` starts an attacker-controlled query string, and `#` truncates the remainder of the intended path. The result is that the authenticated request can be steered to a different Graph endpoint or carry attacker-chosen query parameters, all under the token\u0027s existing scopes. Applications that always send with a fixed, trusted `from` address never reach the injectable path and are unaffected.\n\n### PoC\n\n1. Configure an application to use `Swoosh.Adapters.MsGraph` and derive the email `from` address from user-influenced input (e.g. a contact form\u0027s reply address or a \"send as\" field).\n2. Submit a `from` address whose local part contains URL-special characters, for example one using `/`, `?`, or `#` to escape the `/users/{from}/sendMail` path segment.\n3. Trigger delivery; Swoosh interpolates the address unencoded and sends the application\u0027s authenticated Graph `POST` to the attacker-rewritten path and query string.\n\n### Impact\n\nAn attacker who can influence the sender address can redirect an application\u0027s authenticated Microsoft Graph requests to other endpoints within the bearer token\u0027s scopes and control the request\u0027s query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API.\n\n### References\n\n* Introduction commit: https://github.com/swoosh/swoosh/commit/23bfcdab71aee4613858ba6d116bb3311b72aa58\n* Patch commit: https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61\n* Affected adapter source: https://github.com/swoosh/swoosh/blob/master/lib/swoosh/adapters/ms_graph.ex",
"id": "GHSA-754j-98wh-57rf",
"modified": "2026-10-16T19:22:31Z",
"published": "2026-10-16T19:22:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/swoosh/swoosh/security/advisories/GHSA-754j-98wh-57rf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54893"
},
{
"type": "WEB",
"url": "https://github.com/swoosh/swoosh/commit/23bfcdab71aee4613858ba6d116bb3311b72aa58"
},
{
"type": "WEB",
"url": "https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61"
},
{
"type": "WEB",
"url": "https://cna.erlef.org/cves/CVE-2026-54893.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/swoosh/swoosh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54893"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "swoosh has email-derived URL path injection in Microsoft Graph endpoint"
}
GHSA-75HF-VVF9-P39G
Vulnerability from github – Published: 2025-09-05 15:31 – Updated: 2026-04-01 18:36Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Bonus for Woo: from n/a through 7.4.1.
{
"affected": [],
"aliases": [
"CVE-2025-58835"
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-05T14:15:56Z",
"severity": "MODERATE"
},
"details": "Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Bonus for Woo: from n/a through 7.4.1.",
"id": "GHSA-75hf-vvf9-p39g",
"modified": "2026-04-01T18:36:05Z",
"published": "2025-09-05T15:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58835"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/bonus-for-woo/vulnerability/wordpress-bonus-for-woo-plugin-7-4-1-other-vulnerability-type-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-75R7-WF67-87F9
Vulnerability from github – Published: 2024-06-10 18:31 – Updated: 2024-06-12 18:30A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\SYSTEM. The vulnerability exists within the "Repair" (settings -> troubleshooting -> repair) feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the system. This can provide a low-privileged user an Elevation of Privilege to win a race-condition which will re-create the system files and make Windows callback to a specially-crafted file which could be used to launch a privileged shell instance.
This issue affects Avast Antivirus prior to 24.2.
{
"affected": [],
"aliases": [
"CVE-2024-5102"
],
"database_specific": {
"cwe_ids": [
"CWE-1284",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-10T17:16:34Z",
"severity": "HIGH"
},
"details": "A sym-linked file accessed via the repair function in Avast Antivirus \u003c24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\\SYSTEM.\u00a0The vulnerability exists within the \"Repair\" (settings -\u003e troubleshooting -\u003e repair) feature, which attempts to delete a file in the current user\u0027s AppData directory as NT AUTHORITY\\SYSTEM. A\u00a0low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the system. This can provide a low-privileged user an Elevation of Privilege to win a race-condition which will re-create the system files and make Windows callback to a specially-crafted file which could be used to launch a privileged shell instance.\n\nThis issue affects Avast Antivirus prior to 24.2.",
"id": "GHSA-75r7-wf67-87f9",
"modified": "2024-06-12T18:30:40Z",
"published": "2024-06-10T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5102"
},
{
"type": "WEB",
"url": "https://support.norton.com/sp/static/external/tools/security-advisories.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-75R9-XH7M-QFVX
Vulnerability from github – Published: 2024-09-07 18:30 – Updated: 2024-09-07 18:30A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total leads to improper validation of specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2024-8558"
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-07T16:15:02Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total leads to improper validation of specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-75r9-xh7m-qfvx",
"modified": "2024-09-07T18:30:23Z",
"published": "2024-09-07T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8558"
},
{
"type": "WEB",
"url": "https://github.com/Niu-zida/cve/blob/main/Payment%20loopholes.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.276778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.276778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.403345"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-78VR-Q6CF-C7P6
Vulnerability from github – Published: 2026-06-19 21:15 – Updated: 2026-06-19 21:15Summary
The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.
Details
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Impact
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
Remediation
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.6.4"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/commerce"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.6.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.11.1"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/commerce"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.11.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1284",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T21:15:23Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied \u0027paymentAmount\u0027 parameter directly to float with no lower-bound check. \n\n### Details\n\nWhen the store has \u0027Allow Partial Payment on Checkout\u0027 enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.\n\n\u003cimg width=\"690\" height=\"80\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73\" /\u003e\n\n\u003cimg width=\"761\" height=\"200\" alt=\"image\" src=\"https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77\" /\u003e\n\n### PoC\n\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\u003cimg width=\"606\" height=\"144\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80\" /\u003e\n\n\n### Impact\nOn stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies \u2014 some will process $0.00 transactions, effectively giving free order fulfillment.\n\n**Remediation**\n\n\u003cimg width=\"718\" height=\"98\" alt=\"image\" src=\"https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6\" /\u003e",
"id": "GHSA-78vr-q6cf-c7p6",
"modified": "2026-06-19T21:15:23Z",
"published": "2026-06-19T21:15:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-78vr-q6cf-c7p6"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/commerce/commit/9a88392b3074aa132a9455d4f4b582411df52c74"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/commerce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Craft Commerce: Partial Payment Amount Without Lower Bound Validation"
}
GHSA-797V-2V4C-3XVX
Vulnerability from github – Published: 2026-05-04 15:31 – Updated: 2026-06-30 03:36An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method
{
"affected": [],
"aliases": [
"CVE-2025-70069"
],
"database_specific": {
"cwe_ids": [
"CWE-1284",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T14:16:29Z",
"severity": "HIGH"
},
"details": "An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method",
"id": "GHSA-797v-2v4c-3xvx",
"modified": "2026-06-30T03:36:29Z",
"published": "2026-05-04T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70069"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-70069"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465306"
},
{
"type": "WEB",
"url": "https://gist.github.com/GunP4ng/9080ae7f0470c889a59cc3bfca445223"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-70069.json"
},
{
"type": "WEB",
"url": "http://assimp.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CGG-8926-325V
Vulnerability from github – Published: 2022-02-15 00:02 – Updated: 2023-07-21 18:30The Popup | Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
{
"affected": [],
"aliases": [
"CVE-2022-0214"
],
"database_specific": {
"cwe_ids": [
"CWE-1284",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-14T12:15:00Z",
"severity": "HIGH"
},
"details": "The Popup | Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog",
"id": "GHSA-7cgg-8926-325v",
"modified": "2023-07-21T18:30:33Z",
"published": "2022-02-15T00:02:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0214"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CQ3-5G9G-7W8Q
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.
{
"affected": [],
"aliases": [
"CVE-2026-49078"
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:17:19Z",
"severity": "HIGH"
},
"details": "Unauthenticated Other Vulnerability Type in WP Travel Engine \u003c= 6.7.10 versions.",
"id": "GHSA-7cq3-5g9g-7w8q",
"modified": "2026-06-15T21:30:49Z",
"published": "2026-06-15T21:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49078"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-travel-engine/vulnerability/wordpress-wp-travel-engine-plugin-6-7-10-other-vulnerability-type-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7FHF-99F5-2645
Vulnerability from github – Published: 2025-01-06 06:30 – Updated: 2025-01-06 15:30In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01231341 / MOLY01263331 / MOLY01233835; Issue ID: MSV-2165.
{
"affected": [],
"aliases": [
"CVE-2024-20149"
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T04:15:07Z",
"severity": "HIGH"
},
"details": "In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01231341 / MOLY01263331 / MOLY01233835; Issue ID: MSV-2165.",
"id": "GHSA-7fhf-99f5-2645",
"modified": "2025-01-06T15:30:59Z",
"published": "2025-01-06T06:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20149"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/January-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
No CAPEC attack patterns related to this CWE.