What is the CVSS score of CVE-2024-29131?

CVE-2024-29131 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 2.1%.

Is there a patch available for CVE-2024-29131?

Yes, a patch is available for CVE-2024-29131. Update the affected software to the latest version immediately.

Commons Configuration CVE-2024-29131

HIGH

Out-of-bounds Write (CWE-787)

2024-03-21 security@apache.org

Buffer Overflow Apache Memory Corruption Commons Configuration Fedora Ontap Tools Snapcenter

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Mar 21, 2024 - 09:15 cve.org

HIGH 7.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

171 maven packages depend on org.apache.commons:commons-configuration2 (35 direct, 137 indirect)

Ecosystem-wide dependent count for version 2.0.

DescriptionCVE.org

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1, which fixes the issue.

AnalysisAI

Out-of-bounds Write vulnerability in Apache Commons Configuration.0 before 2.10.1. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. Out-of-bounds Write vulnerability in Apache Commons Configuration.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue. Affected products include: Apache Commons Configuration, Fedoraproject Fedora, Netapp Ontap Tools, Netapp Snapcenter. Version information: before 2.10.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).