What is the CVSS score of CVE-2024-6873?

CVE-2024-6873 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.7%.

It CVE-2024-6873

HIGH

Heap-based Buffer Overflow (CWE-122)

2024-08-01 cb7ba516-3b07-4c98-b0c2-715220f1a8f6

Heap Overflow Buffer Overflow RCE

8.1

CVSS 3.1 · Vendor: cb7ba516-3b07-4c98-b0c2-715220f1a8f6

Severity by source

Vendor (cb7ba516-3b07-4c98-b0c2-715220f1a8f6) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

Primary rating from Vendor (cb7ba516-3b07-4c98-b0c2-715220f1a8f6) · only source for this CVE.

CVSS VectorVendor: cb7ba516-3b07-4c98-b0c2-715220f1a8f6

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Aug 01, 2024 - 16:15 cve.org

HIGH 8.1

DescriptionCVE.org

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.

Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit https://github.com/ClickHouse/ClickHouse/pull/64024 .

AnalysisAI

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-122. It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited. Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit https://github.com/ClickHouse/ClickHouse/pull/64024 .

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.