{"id":"CVE-2024-52060","state":"PUBLISHED","title":"Potential stack overflow when using XML configuration file referencing environment variables","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45.","publishedAt":"2024-12-13T10:19:22.641Z","updatedAt":"2025-02-07T21:48:32.911Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","source":"RTI"},"assigner":"RTI","products":["RTI Connext Professional"],"affected":[{"vendor":"RTI","product":"Connext Professional","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.3.0.5","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.2.21","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.1.40","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.1.45","versionType":"custom"}],"modules":["Routing Service","Recording Service","Queuing Service","Observability Collector Service","Cloud Discovery Service"]}],"references":["https://www.rti.com/vulnerabilities/#cve-2024-52060"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/52xxx/CVE-2024-52060.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-52060","state":"PUBLISHED","datePublished":"2024-12-13T10:19:22.641Z","dateUpdated":"2025-02-07T21:48:32.911Z","assignerShortName":"RTI","assignerOrgId":"3f572a00-62e2-4423-959a-7ea25eff1638","dateReserved":"2024-11-05T19:04:16.675Z"},"containers":{"cna":{"title":"Potential stack overflow when using XML configuration file referencing environment variables","descriptions":[{"lang":"en","value":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45."}],"affected":[{"vendor":"RTI","product":"Connext Professional","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.3.0.5","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.2.21","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.1.40","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.1.45","versionType":"custom"}],"modules":["Routing Service","Recording Service","Queuing Service","Observability Collector Service","Cloud Discovery Service"]}],"references":[{"url":"https://www.rti.com/vulnerabilities/#cve-2024-52060"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":8.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"RTI","orgId":"3f572a00-62e2-4423-959a-7ea25eff1638","dateUpdated":"2025-02-07T21:48:32.911Z"},"datePublic":"2024-12-12T16:00:00.000Z","impacts":[{"capecId":"CAPEC-10","descriptions":[{"lang":"en","value":"CAPEC-10 Buffer Overflow via Environment Variables"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"},"cpeApplicability":[{"nodes":[{"operator":"OR","negated":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.3.0.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.0","versionEndExcluding":"6.1.2.21"},{"vulnerable":true,"criteria":"cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.1.40"},{"vulnerable":true,"criteria":"cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3.0","versionEndExcluding":"5.3.1.45"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-23T20:05:56.348454Z","id":"CVE-2024-52060","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-23T20:06:08.452Z"}}]}}}