// For flags

CVE-2023-42319

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.

Geth (también conocido como go-ethereum) hasta 1.13.4, cuando se usa --http --graphql, permite a atacantes remotos provocar una Denegación de Servicio (consumo de memoria y bloqueo del daemon) a través de una consulta GraphQL manipulada. NOTA: la posición del proveedor es que "el endpoint Graphql [no está] diseñado para resistir ataques de clientes hostiles ni para manejar grandes cantidades de clientes/tráfico.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-09-08 CVE Reserved
  • 2023-10-18 CVE Published
  • 2024-09-13 CVE Updated
  • 2024-09-13 First Exploit
  • 2024-11-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ethereum
Search vendor "Ethereum"
 Go Ethereum
Search vendor "Ethereum" for product "Go Ethereum"
 <= 1.13.4
Search vendor "Ethereum" for product "Go Ethereum" and version " <= 1.13.4"
-
Affected