CVE search · CVE-2024-30170
CVE-2024-30170
critical 9.1
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- NVD-CWE-noinfo, CWE-400
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- ssh · privx
References
- https://info.ssh.com/improper-input-validation-faqExploitVendor Advisory
- https://privx.docs.ssh.com/docs/securityVendor Advisory