Resource exhaustion in Red Hat Jboss Aerogear
CVE-2014-3648
The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (60.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 60.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.010 · change: +0.001
Affected products
- Red Hat Jboss Aerogear — versions 1.0.0
- Jboss Aerogear — versions Jboss Aerogear 1.0.0.final
Weakness classification (CWE)
References
- issues.redhat.com/browse/AEROGEAR-6091 (Permissions Required, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2014-3648?
- CVE-2014-3648 is a high-severity vulnerability in Red Hat Jboss Aerogear, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2022-07-01.
- How severe is CVE-2014-3648?
- High severity. CVSS v3 base score is 7.5 out of 10.