Medium severity · published Oct 3, 2024
CVE-2024-47554
Uncontrolled Resource Consumption vulnerability in Apache Commons IO
4.3
CVSS
1.3%
EPSS
No
On KEV
Description
Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BL
Bluexp · Netapp
All versions, or not specified · source: NVD
CI
Commons IO · Apache
2.0 before 2.14.0 · source: NVD
ES
E-series Santricity Unified Manager · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity Web Services Proxy · Netapp
All versions, or not specified · source: NVD
OT
Ontap Tools · Netapp
9; 10 · source: NVD
SS
Santricity Storage Plugin · Netapp
All versions, or not specified · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47554
Mailing List
https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/03/2
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0010/
More from Commons IO
4.8
CVE-2021-29425
Possible limited path traversal vulnerabily in Apache Commons IO