Zurück zur CVE-Übersicht
CVE-2023-44487
HIGH(7.5)KEV — Aktiv ausgenutztCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Risk Signal Score79/100 — KRITISCH
- CVSS 7.5 — Hoch
- EPSS 100% — sehr wahrscheinlich ausgenutzt
- Im CISA KEV-Katalog (aktiv ausgenutzt)
CISA KEV
Bestätigt ausgenutzt
EPSS-Score
100%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.5
Technische Schwere
Beschreibung
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Betroffene Produkte
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:st7_scadaconnect:*:*:*:*:*:*:*:*
- cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*
- cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Referenzen
- http://www.openwall.com/lists/oss-security/2023/10/10/6
- http://www.openwall.com/lists/oss-security/2023/10/10/7
- http://www.openwall.com/lists/oss-security/2023/10/13/4
- http://www.openwall.com/lists/oss-security/2023/10/13/9
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- http://www.openwall.com/lists/oss-security/2023/10/19/6
- http://www.openwall.com/lists/oss-security/2023/10/20/8
- https://access.redhat.com/security/cve/cve-2023-44487
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to...