CVE-2024-10935: fallo de gravedad alta en automatic1111/stable-diffusion-webui
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.8%
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
automatic1111 · automatic1111/stable-diffusion-webuiCVEs relacionadas — automatic1111/stable-diffusion-webui
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-12375MEDIUMLocal File Inclusion in automatic1111/stable-diffusion-webuiEPSS 0.9%CVE-2024-11044MEDIUMOpen Redirect in automatic1111/stable-diffusion-webuiEPSS 0.8%CVE-2024-12074MEDIUMDenial of Service in automatic1111/stable-diffusion-webuiEPSS 0.8%CVE-2024-12374MEDIUMStored XSS in automatic1111/stable-diffusion-webuiEPSS 0.4%CVE-2024-11045CRITICALCross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webuiEPSS 0.4%