How severe is CVE-2024-23672?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.3 out of 10.

What type of vulnerability is CVE-2024-23672?

This is classified as CWE-459, which is a common weakness in software security.

CVE-2024-23672 - MEDIUM Severity | CVSS 6.3

Vulnerability Description

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Related Vulnerabilities

CVE-2023-20862

MEDIUM

CVSS:6.3(Medium)

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized...

CWE-4592023

CVE-2019-12902

MEDIUM

CVSS:6.5(Medium)

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data.

CWE-4592019

CVE-2020-12414

MEDIUM

CVSS:6.5(Medium)

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted ...

CWE-4592020

CVE-2020-12624

MEDIUM

CVSS:6.5(Medium)

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which...

CWE-4592020

CVE-2020-13346

MEDIUM

CVSS:6.5(Medium)

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

CWE-4592020

CVE-2022-37428

MEDIUM

CVSS:6.5(Medium)

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS qu...

CWE-4592022