CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
5567 vulnerabilities reference this CWE, most recent first.
CVE-2014-2342 (GCVE-0-2014-2342)
Vulnerability from cvelistv5 – Published: 2014-05-30 23:00 – Updated: 2025-10-02 22:17| URL | Tags |
|---|---|
| http://www.trianglemicroworks.com/products/scada-… | x_refsource_MISC |
| https://www.cisa.gov/news-events/ics-advisories/i… | |
| http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01 | x_refsource_MISCx_transferred |
| Vendor | Product | Version | |
|---|---|---|---|
| Triangle MicroWorks | SCADA Data Gateway |
Affected:
0 , < v3.00.0635
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.053Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SCADA Data Gateway",
"vendor": "Triangle MicroWorks",
"versions": [
{
"lessThan": "v3.00.0635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Crain of Automatak and Chris Sistrunk of Mandiant"
}
],
"datePublic": "2014-05-29T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTriangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.\u003c/p\u003e"
}
],
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-02T22:17:05.858Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTriangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/SupportPage.htm\"\u003ehttp://www.trianglemicroworks.com/SupportPage.htm\u003c/a\u003e\u003c/p\u003e\u003cp\u003eRelease notes are found here:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\"\u003ehttp://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new\u003c/a\u003e\u003c/p\u003e\u003cp\u003eTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Triangle MicroWorks has produced an update and release notes describing the mitigation. Please contact Triangle MicroWorks Support for details on specific platform updates here:\n\n http://www.trianglemicroworks.com/SupportPage.htm \n\nRelease notes are found here:\n\n http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new \n\nTriangle MicroWorks recommends following the International Electrotechnical Commission (IEC) Technical Specification TS 62351 to reduce the risk from vulnerability. More information on recommended implementation practices for Triangle MicroWorks products is available by contacting your product representative."
}
],
"source": {
"advisory": "ICSA-14-149-01",
"discovery": "EXTERNAL"
},
"title": "Triangle MicroWorks SCADA Data Gateway Resource Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2342",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new",
"refsource": "MISC",
"url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
},
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2342",
"datePublished": "2014-05-30T23:00:00.000Z",
"dateReserved": "2014-03-13T00:00:00.000Z",
"dateUpdated": "2025-10-02T22:17:05.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-224F-WM46-5P4R
Vulnerability from github – Published: 2026-02-13 18:31 – Updated: 2026-02-13 21:31An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.
{
"affected": [],
"aliases": [
"CVE-2025-66676"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T18:16:17Z",
"severity": "MODERATE"
},
"details": "An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.",
"id": "GHSA-224f-wm46-5p4r",
"modified": "2026-02-13T21:31:36Z",
"published": "2026-02-13T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66676"
},
{
"type": "WEB",
"url": "https://github.com/cwjchoi01/CVE-2025-66676"
},
{
"type": "WEB",
"url": "https://www.iobit.com/en/iobit-unlocker.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-224P-V68G-5G8F
Vulnerability from github – Published: 2025-08-26 18:45 – Updated: 2025-08-26 18:45Summary
A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled (which is the default configuration) by naming your query/fragment __schema.
Details
In the countDepth function, we have the following code that calculates the depth of a used fragment:
} else if (node.kind == Kind.FRAGMENT_SPREAD) {
if (this.visitedFragments.has(node.name.value)) {
return this.visitedFragments.get(node.name.value) ?? 0;
} else {
this.visitedFragments.set(node.name.value, -1);
}
const fragment = this.context.getFragment(node.name.value);
if (fragment) {
let fragmentDepth;
if (this.config.flattenFragments) {
fragmentDepth = this.countDepth(fragment, parentDepth);
} else {
fragmentDepth = this.countDepth(fragment, parentDepth + 1);
}
depth = Math.max(depth, fragmentDepth);
if (this.visitedFragments.get(node.name.value) === -1) {
this.visitedFragments.set(node.name.value, fragmentDepth);
}
}
}
which will calculate the depth of the fragment used in the current node, store the value in this.visitedFragments and re-use it in the future to avoid re-calculating the depth for the same fragment.
The issue arises when the same fragment is used multiple times, at different depths. The current caching takes into account the depth of the first occurrence, which means if the fragment is re-used later in a higher depth, this cached value is not updated.
So, for example, sending the following query with a max depth of 6:
query {
books {
author {
...Test
}
}
books {
author {
books {
author {
...Test
}
}
}
}
}
fragment Test on Author {
books {
title
}
}
The first use of Test fragment does not exceed the defined limit, and this depth will be cached.
In the second use, the fragment is reused in a greater depth, but the countDepth function will still use the depth cached, without accounting for the increased depth.
PoC
Max depth: 6
query {
books {
author {
...Test
}
}
books {
author {
books {
author {
...Test
}
}
}
}
}
fragment Test on Author {
books {
title
}
}
Impact
This issue affects applications using the GraphQL Armor Depth Limit plugin.
Fix
This is fixed in PR#824. We now store only the additional depth contributed by the fragment and add it to the parent depth where the fragment is used (parentDepth).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.4.1"
},
"package": {
"ecosystem": "npm",
"name": "@escape.tech/graphql-armor-max-depth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-26T18:45:55Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nA query depth restriction using the max-depth can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`.\n\n### Details\nIn the `countDepth` function, we have the following code that calculates the depth of a used fragment:\n\n```typescript\n } else if (node.kind == Kind.FRAGMENT_SPREAD) {\n if (this.visitedFragments.has(node.name.value)) {\n return this.visitedFragments.get(node.name.value) ?? 0;\n } else {\n this.visitedFragments.set(node.name.value, -1);\n }\n const fragment = this.context.getFragment(node.name.value);\n if (fragment) {\n let fragmentDepth;\n if (this.config.flattenFragments) {\n fragmentDepth = this.countDepth(fragment, parentDepth);\n } else {\n fragmentDepth = this.countDepth(fragment, parentDepth + 1);\n }\n depth = Math.max(depth, fragmentDepth);\n if (this.visitedFragments.get(node.name.value) === -1) {\n this.visitedFragments.set(node.name.value, fragmentDepth);\n }\n }\n }\n```\n\nwhich will calculate the depth of the fragment used in the current node, store the value in `this.visitedFragments` and re-use it in the future to avoid re-calculating the depth for the same fragment.\n\nThe issue arises when the same fragment is used multiple times, **at different depths**. The current caching takes into account the depth of the first occurrence, which means if the fragment is re-used later in a higher depth, this cached value is not updated.\n\nSo, for example, sending the following query with a max depth of `6`:\n\n```graphql\nquery {\n books {\n author {\n ...Test\n }\n }\n books {\n author {\n books {\n author {\n ...Test\n }\n }\n }\n }\n}\nfragment Test on Author {\n books {\n title\n }\n}\n```\n\nThe first use of `Test` fragment does not exceed the defined limit, and this depth will be cached.\n\nIn the second use, the fragment is reused in a greater depth, but the `countDepth` function will still use the depth cached, without accounting for the increased depth.\n\n### PoC\n\nMax depth: `6`\n\n```graphql\nquery {\n books {\n author {\n ...Test\n }\n }\n books {\n author {\n books {\n author {\n ...Test\n }\n }\n }\n }\n}\nfragment Test on Author {\n books {\n title\n }\n}\n```\n\n### Impact\n\nThis issue affects applications using the GraphQL Armor Depth Limit plugin.\n\n### Fix\n\nThis is fixed in [PR#824](https://github.com/Escape-Technologies/graphql-armor/pull/824). We now store only the additional depth contributed by the fragment and add it to the parent depth where the fragment is used (`parentDepth`).",
"id": "GHSA-224p-v68g-5g8f",
"modified": "2025-08-26T18:45:55Z",
"published": "2025-08-26T18:45:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/security/advisories/GHSA-224p-v68g-5g8f"
},
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/pull/824"
},
{
"type": "WEB",
"url": "https://github.com/Escape-Technologies/graphql-armor/commit/998986109f8c2313bd61325ddfe7f5dcd48f9232"
},
{
"type": "PACKAGE",
"url": "https://github.com/Escape-Technologies/graphql-armor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "GraphQL Armor Max-Depth Plugin Bypass via fragment caching"
}
GHSA-2252-JWP3-QXFH
Vulnerability from github – Published: 2024-05-06 15:30 – Updated: 2024-05-06 15:30A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
{
"affected": [],
"aliases": [
"CVE-2024-4549"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T14:15:08Z",
"severity": "CRITICAL"
},
"details": "A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an \u0027ICS Restart!\u0027 message, CEBC.exe restarts the system.",
"id": "GHSA-2252-jwp3-qxfh",
"modified": "2024-05-06T15:30:38Z",
"published": "2024-05-06T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4549"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2024-13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2254-9C75-9FPV
Vulnerability from github – Published: 2023-05-15 15:30 – Updated: 2024-04-02 15:30The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
{
"affected": [],
"aliases": [
"CVE-2023-32787"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-15T15:15:12Z",
"severity": "HIGH"
},
"details": "The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.",
"id": "GHSA-2254-9c75-9fpv",
"modified": "2024-04-02T15:30:36Z",
"published": "2023-05-15T15:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32787"
},
{
"type": "WEB",
"url": "https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0"
},
{
"type": "WEB",
"url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf"
},
{
"type": "WEB",
"url": "https://github.com/OPCFoundation/UA-Java-Legacy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2258-94H3-MGHH
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-48576"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T17:16:15Z",
"severity": "MODERATE"
},
"details": "In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-2258-94h3-mghh",
"modified": "2025-12-08T21:30:20Z",
"published": "2025-12-08T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48576"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/b812baa1463c9f9e81efa617c9d08ed7a63488b4"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-227G-7CVV-6FF3
Vulnerability from github – Published: 2022-07-14 00:00 – Updated: 2022-07-22 16:31Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tapestry:tapestry-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31781"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-15T18:33:51Z",
"nvd_published_at": "2022-07-13T08:15:00Z",
"severity": "HIGH"
},
"details": "Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there\u0027s some non-Tapestry codepath passing some outside input to the ContentType class constructor.",
"id": "GHSA-227g-7cvv-6ff3",
"modified": "2022-07-22T16:31:43Z",
"published": "2022-07-14T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31781"
},
{
"type": "WEB",
"url": "https://github.com/apache/tapestry-5/commit/3c8d6103832eec3bc06029dd2532f06df717431f"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/07/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking"
}
GHSA-2298-J2FR-472H
Vulnerability from github – Published: 2023-06-07 18:30 – Updated: 2024-04-04 04:39A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
{
"affected": [],
"aliases": [
"CVE-2023-0121"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-07T17:15:09Z",
"severity": "HIGH"
},
"details": "A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.",
"id": "GHSA-2298-j2fr-472h",
"modified": "2024-04-04T04:39:30Z",
"published": "2023-06-07T18:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0121"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1774688"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/387549"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-22CP-W34C-5QXR
Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2024-10-16 18:31The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) through 2022-06-27 performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.
{
"affected": [],
"aliases": [
"CVE-2022-40306"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) through 2022-06-27 performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.",
"id": "GHSA-22cp-w34c-5qxr",
"modified": "2024-10-16T18:31:33Z",
"published": "2022-09-16T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40306"
},
{
"type": "WEB",
"url": "https://releasenotes.printanista.net/PrintanistaHub"
},
{
"type": "WEB",
"url": "https://www.ecisolutions.com/products/printanista-hub"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-042.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-22JH-HQF7-V4MW
Vulnerability from github – Published: 2022-06-16 00:00 – Updated: 2025-01-02 21:31Windows Network Address Translation (NAT) Denial of Service Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-30152"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-15T22:15:00Z",
"severity": "HIGH"
},
"details": "Windows Network Address Translation (NAT) Denial of Service Vulnerability.",
"id": "GHSA-22jh-hqf7-v4mw",
"modified": "2025-01-02T21:31:37Z",
"published": "2022-06-16T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30152"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30152"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.