High Severity Vulnerability
This vulnerability has been rated as High severity. Immediate action is recommended.
CVE-2024-29131
High
Low
Medium
High
Critical
7.3
CVSS Score
Vulnerability Description
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
L
Integrity
L
Availability
L
Known Affected Software
16 configuration(s) from 3 vendor(s)
commons_configuration
Version:
2.6
CPE:
cpe:2.3:a:apache:commons_configuration:2.6:*:*:*:*:*:*:*
commons_configuration
Version:
2.3
CPE:
cpe:2.3:a:apache:commons_configuration:2.3:*:*:*:*:*:*:*
commons_configuration
Version:
2.10.0
CPE:
cpe:2.3:a:apache:commons_configuration:2.10.0:*:*:*:*:*:*:*
commons_configuration
Version:
2.4
CPE:
cpe:2.3:a:apache:commons_configuration:2.4:*:*:*:*:*:*:*
commons_configuration
Version:
2.7
CPE:
cpe:2.3:a:apache:commons_configuration:2.7:*:*:*:*:*:*:*
commons_configuration
Version:
2.0
CPE:
cpe:2.3:a:apache:commons_configuration:2.0:-:*:*:*:*:*:*
commons_configuration
Version:
2.9.0
CPE:
cpe:2.3:a:apache:commons_configuration:2.9.0:*:*:*:*:*:*:*
commons_configuration
Version:
2.2
CPE:
cpe:2.3:a:apache:commons_configuration:2.2:*:*:*:*:*:*:*
commons_configuration
Version:
2.1
CPE:
cpe:2.3:a:apache:commons_configuration:2.1:*:*:*:*:*:*:*
commons_configuration
Version:
2.5
CPE:
cpe:2.3:a:apache:commons_configuration:2.5:*:*:*:*:*:*:*
commons_configuration
Version:
2.1.1
CPE:
cpe:2.3:a:apache:commons_configuration:2.1.1:*:*:*:*:*:*:*
commons_configuration
Version:
2.8
CPE:
cpe:2.3:a:apache:commons_configuration:2.8:*:*:*:*:*:*:*
fedora
Version:
40
CPE:
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
fedora
Version:
39
CPE:
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
ontap_tools
Version:
10
CPE:
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
snapcenter
Version:
-
CPE:
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
This vulnerability affects 16 software configuration(s). Ensure you patch all affected systems.
Oracle
CPUAPR2025
Oracle Critical Patch Update Advisory - April 2025
Severity
Critical
Released
Apr 15, 2025
Restart Required
Security Update
Oracle
CPUJAN2025
Oracle Critical Patch Update Advisory - January 2025
Severity
Critical
Released
Jan 21, 2025
Restart Required
Security Update
References & Resources
-
http://www.openwall.com/lists/oss-security/2024/03/20/4security@apache.org Mailing List Third Party Advisory
-
https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37security@apache.org Mailing List Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/security@apache.org Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS/security@apache.org Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2024/03/20/4af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37af854a3a-2127-422b-91ae-364da2661108 Mailing List Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20241213-0001/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
Severity Details
7.3
out of 10.0
High
Weakness Type (CWE)
CWE-787
Top 25 #2
Out-of-bounds Write
- Description
- The product writes data past the end, or before the beginning, of the intended buffer.
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Base
Key Information
- Published Date
- March 21, 2024
