CVE-2023-28425CWE-77

Specially crafted MSETNX command can lead to denial-of-service

Medium · published March 20, 2023

Patch now

High probability of exploitation

CVSS calls it medium at 5.5. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
5.5
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.58526 · 99.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2023-03-20T19:03Z
EPSS history
Timeline
  • 20 MAR 19:03Z
    Specially crafted MSETNX command can lead to denial-of-service
    cvelistv5