{"id":"CVE-2023-24574","state":"PUBLISHED","title":"CVE-2023-24574","description":"\nDell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an \"Uncontrolled Resource Consumption vulnerability\" in authentication component. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to uncontrolled resource consumption by creating permanent home directories for unauthenticated users.\n\n","publishedAt":"2023-02-02T16:04:58.071Z","updatedAt":"2025-03-27T13:26:26.696Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"dell"},"assigner":"dell","products":["Dell Enterprise SONiC OS"],"affected":[{"vendor":"Dell","product":"Enterprise SONiC OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.5.3, 3.5.4, 4.0.0, 4.0.1, 4.0.2","versionType":"custom"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/24xxx/CVE-2023-24574.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-24574","state":"PUBLISHED","datePublished":"2023-02-02T16:04:58.071Z","dateUpdated":"2025-03-27T13:26:26.696Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2023-01-26T16:27:33.569Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"\nDell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an \"Uncontrolled Resource Consumption vulnerability\" in authentication component. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to uncontrolled resource consumption by creating permanent home directories for unauthenticated users.\n\n"}],"affected":[{"vendor":"Dell","product":"Enterprise SONiC OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.5.3, 3.5.4, 4.0.0, 4.0.1, 4.0.2","versionType":"custom"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2023-02-02T16:04:58.071Z"},"datePublic":"2023-02-01T06:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:03:19.230Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-27T13:26:21.319725Z","id":"CVE-2023-24574","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-27T13:26:26.696Z"}}]}}}