CVE-2024-28867 — MEDIUM (5.9)

Vulnerability Description

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing "bogus" metrics. This vulnerability is fixed in2.0.0-alpha.2.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Apple	Swift Prometheus	2.0.0

Related Weaknesses (CWE)

CWE-74

References

https://github.com/swift-server/swift-prometheus/commit/bfcd4bbfabe11aae4b035424Patch
https://github.com/swift-server/swift-prometheus/security/advisories/GHSA-x768-cExploitMitigationVendor Advisory
https://github.com/swift-server/swift-prometheus/commit/bfcd4bbfabe11aae4b035424Patch
https://github.com/swift-server/swift-prometheus/security/advisories/GHSA-x768-cExploitMitigationVendor Advisory

FAQ

What is CVE-2024-28867?

CVE-2024-28867 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an ...

How severe is CVE-2024-28867?

CVE-2024-28867 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-28867?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Swift Prometheus.