Common Weakness Enumeration
CWE-459
AllowedIncomplete Cleanup
Abstraction: Base · Status: Draft
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
238 vulnerabilities reference this CWE, most recent first.
GHSA-QWXP-946X-P86V
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50
VLAI
Details
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-19961"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-08T04:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.",
"id": "GHSA-qwxp-946x-p86v",
"modified": "2022-05-13T01:50:54Z",
"published": "2022-05-13T01:50:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19961"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX239432"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4369"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-275.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106182"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R9HW-MJ3W-PHCQ
Vulnerability from github – Published: 2026-07-06 21:54 – Updated: 2026-07-06 21:54
VLAI
Summary
mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
Details
uutils calls mknod before setting the SELinux context (GNU uses setfscreatecon first, labeling atomically). If set_selinux_security_context fails, cleanup uses std::fs::remove_dir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind.
Impact: on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use setfscreatecon before mknod, abort on failure, and use remove_file for cleanup.
Remediation: Acknowledged by Canonical.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.58. Credit: Zellic.
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_mknod"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35361"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-459",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T21:54:05Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "uutils calls `mknod` *before* setting the SELinux context (GNU uses `setfscreatecon` first, labeling atomically). If `set_selinux_security_context` fails, cleanup uses `std::fs::remove_dir`, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind.\n\n**Impact:** on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use `setfscreatecon` before `mknod`, abort on failure, and use `remove_file` for cleanup.\n\n**Remediation:** Acknowledged by Canonical.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.58. Credit: Zellic._",
"id": "GHSA-r9hw-mj3w-phcq",
"modified": "2026-07-06T21:54:05Z",
"published": "2026-07-06T21:54:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-r9hw-mj3w-phcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35361"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/10582"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/42b2ad83cdcf6e959ecb378c5040c60d9c64becf"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)"
}
GHSA-R9VW-PX66-GX7G
Vulnerability from github – Published: 2022-05-01 02:01 – Updated: 2024-02-08 21:30
VLAI
Details
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2005-1744"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-05-24T04:00:00Z",
"severity": "HIGH"
},
"details": "BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.",
"id": "GHSA-r9vw-px66-gx7g",
"modified": "2024-02-08T21:30:31Z",
"published": "2022-05-01T02:01:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1744"
},
{
"type": "WEB",
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/15486"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1014049"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2005/0604"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RCGX-6RCQ-V2MX
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-26 00:00
VLAI
Details
Under certain circumstances the session token is not cleared on logout.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-36205"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Under certain circumstances the session token is not cleared on logout.",
"id": "GHSA-rcgx-6rcq-v2mx",
"modified": "2022-04-26T00:00:58Z",
"published": "2022-04-16T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36205"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RFJG-6M84-CRJ2
Vulnerability from github – Published: 2026-02-28 01:59 – Updated: 2026-02-28 01:59
VLAI
Summary
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
Details
Summary A critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.
This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.
Technical Analysis The vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.
- Logic Error in Password Reset (No Invalidation) In pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user's password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.
Vulnerable Code: pkg/user/user_password_reset.go (Lines 36-94)
func ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) {
// ... [Validation and User Lookup] ...
// Hash the password
user.Password, err = HashPassword(reset.NewPassword)
if err != nil {
return
}
// FLAW: Deletes 'TokenEmailConfirm' instead of the current 'TokenPasswordReset'
err = removeTokens(s, user, TokenEmailConfirm)
if err != nil {
return
}
// ... [Update User Status and Return] ...
// The reset token is never removed and remains valid in the DB.
}
- Logic Error in Token Cleanup (Inverted Expiry) The background cron job intended to expire old tokens contains an inverted comparison operator. It deletes tokens newer than 24 hours instead of older ones.
Vulnerable Code: pkg/user/token.go (Lines 125-151)
func RegisterTokenCleanupCron() {
// ...
err := cron.Schedule("0 * * * *", func() {
// ...
// FLAW: "created > ?" selects tokens created AFTER 24 hours ago.
// This deletes NEW valid tokens and keeps OLD expired tokens forever.
deleted, err := s.
Where("created > ? AND (kind = ? OR kind = ?)",
time.Now().Add(time.Hour*24*-1),
TokenPasswordReset, TokenAccountDeletion).
Delete(&Token{})
// ...
})
}
Impact Persistent Account Takeover: An attacker with a single valid token can reset the victim's password an unlimited number of times.
Bypass of Remediation: Even if the victim notices suspicious activity and changes their password, the attacker can use the same old token to reset it again immediately.
Infinite Attack Window: Because the cleanup cron is broken, the token effectively has a generic TTL of "forever," allowing exploitation months or years after the token was issued.
Remediation
1. Invalidate Token on Use
Update ResetPassword to delete the specific reset token upon successful completion.
// Recommended Fix
err = removeTokens(s, user, TokenPasswordReset) // Correct TokenKind
2. Fix Cleanup Logic
Update the SQL query in RegisterTokenCleanupCron to target tokens created before the cutoff time.
// Recommended Fix
Where("created < ? ...", time.Now().Add(time.Hour*24*-1), ...) // Use Less Than (<)
A fix is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.1.0
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.24.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28268"
],
"database_specific": {
"cwe_ids": [
"CWE-459",
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-28T01:59:28Z",
"nvd_published_at": "2026-02-27T21:16:18Z",
"severity": "CRITICAL"
},
"details": "**Summary**\nA critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.\n\nThis allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.\n\n**Technical Analysis**\nThe vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.\n\n1. Logic Error in Password Reset (No Invalidation)\nIn pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user\u0027s password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.\n\nVulnerable Code: pkg/user/user_password_reset.go (Lines 36-94)\n```\nfunc ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) {\n // ... [Validation and User Lookup] ...\n\n // Hash the password\n user.Password, err = HashPassword(reset.NewPassword)\n if err != nil {\n return\n }\n\n // FLAW: Deletes \u0027TokenEmailConfirm\u0027 instead of the current \u0027TokenPasswordReset\u0027\n err = removeTokens(s, user, TokenEmailConfirm)\n if err != nil {\n return\n }\n\n // ... [Update User Status and Return] ...\n // The reset token is never removed and remains valid in the DB.\n}\n```\n2. Logic Error in Token Cleanup (Inverted Expiry)\nThe background cron job intended to expire old tokens contains an inverted comparison operator. It deletes tokens newer than 24 hours instead of older ones.\n\nVulnerable Code: pkg/user/token.go (Lines 125-151)\n```\nfunc RegisterTokenCleanupCron() {\n // ...\n err := cron.Schedule(\"0 * * * *\", func() {\n // ...\n // FLAW: \"created \u003e ?\" selects tokens created AFTER 24 hours ago.\n // This deletes NEW valid tokens and keeps OLD expired tokens forever.\n deleted, err := s.\n Where(\"created \u003e ? AND (kind = ? OR kind = ?)\", \n time.Now().Add(time.Hour*24*-1), \n TokenPasswordReset, TokenAccountDeletion).\n Delete(\u0026Token{})\n // ...\n })\n}\n\n```\n\n**Impact**\nPersistent Account Takeover: An attacker with a single valid token can reset the victim\u0027s password an unlimited number of times.\n\nBypass of Remediation: Even if the victim notices suspicious activity and changes their password, the attacker can use the same old token to reset it again immediately.\n\nInfinite Attack Window: Because the cleanup cron is broken, the token effectively has a generic TTL of \"forever,\" allowing exploitation months or years after the token was issued.\n\n**Remediation**\n1. Invalidate Token on Use\nUpdate ResetPassword to delete the specific reset token upon successful completion.\n`// Recommended Fix\nerr = removeTokens(s, user, TokenPasswordReset) // Correct TokenKind`\n2. Fix Cleanup Logic\nUpdate the SQL query in RegisterTokenCleanupCron to target tokens created before the cutoff time.\n`// Recommended Fix\nWhere(\"created \u003c ? ...\", time.Now().Add(time.Hour*24*-1), ...) // Use Less Than (\u003c)`\n\nA fix is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.1.0",
"id": "GHSA-rfjg-6m84-crj2",
"modified": "2026-02-28T01:59:28Z",
"published": "2026-02-28T01:59:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rfjg-6m84-crj2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28268"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://vikunja.io/changelog/vikunja-v2.1.0-was-released"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse"
}
GHSA-RG58-XHH7-MQJW
Vulnerability from github – Published: 2025-12-10 12:31 – Updated: 2025-12-10 17:21
VLAI
Summary
Apache Struts has a Denial of Service vulnerability
Details
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Severity
8.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.struts:struts2-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "6.8.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.struts:struts2-core"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66675"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-10T17:21:39Z",
"nvd_published_at": "2025-12-10T10:16:02Z",
"severity": "HIGH"
},
"details": "Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.",
"id": "GHSA-rg58-xhh7-mqjw",
"modified": "2025-12-10T17:21:39Z",
"published": "2025-12-10T12:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66675"
},
{
"type": "WEB",
"url": "https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468"
},
{
"type": "WEB",
"url": "https://cve.org/CVERecord?id=CVE-2025-64775"
},
{
"type": "WEB",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-068"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/struts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Struts has a Denial of Service vulnerability"
}
GHSA-RJ66-WVW5-RCVP
Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-08-13 18:31
VLAI
Details
Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-20518"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T17:15:19Z",
"severity": "LOW"
},
"details": "Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality.",
"id": "GHSA-rj66-wvw5-rcvp",
"modified": "2024-08-13T18:31:15Z",
"published": "2024-08-13T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20518"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RXP8-2RXW-2RGW
Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31
VLAI
Details
Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-20712"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T18:17:24Z",
"severity": "MODERATE"
},
"details": "Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.",
"id": "GHSA-rxp8-2rxw-2rgw",
"modified": "2026-08-11T18:31:54Z",
"published": "2026-08-11T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20712"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01437.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V4XF-4525-WQQ9
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04
VLAI
Details
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-24489"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T20:15:00Z",
"severity": "HIGH"
},
"details": "Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-v4xf-4525-wqq9",
"modified": "2022-05-24T19:04:26Z",
"published": "2022-05-24T19:04:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24489"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4934"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V682-8VV8-VPWR
Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2025-08-08 18:33
VLAI
Summary
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
Details
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
Severity
6.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.0.0-M16"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.0-M17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.1.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.85"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.86"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.5.98"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.99"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.0.0-M16"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.0-M17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.1.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.85"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.86"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.5.98"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-websocket"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.99"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-23672"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-14T14:04:03Z",
"nvd_published_at": "2024-03-13T16:15:29Z",
"severity": "MODERATE"
},
"details": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.",
"id": "GHSA-v682-8vv8-vpwr",
"modified": "2025-08-08T18:33:22Z",
"published": "2024-03-13T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240402-0002"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/13/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat"
}
Mitigation
Architecture and Design
Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
No CAPEC attack patterns related to this CWE.