CVE-2024-5552CWE-1333

ReDoS in kubeflow/kubeflow

High · published June 6, 2024

CVSS v3.0
7.5
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00649 · 50.5th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-06-06T18:09Z
EPSS history
Timeline
  • 06 JUN 18:09Z
    ReDoS in kubeflow/kubeflow
    cvelistv5