Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-39792
CVE-2024-39792:
Nginx Plus vulnerability analysis and mitigation
Overview
A vulnerability in NGINX Plus, identified as CVE-2024-39792, affects systems configured to use the MQTT pre-read module. The vulnerability was disclosed on August 14, 2024, and affects NGINX Plus versions R30 through R32. When exploited, this vulnerability can cause an increase in memory resource utilization (CERT-EU, NVD).
Technical details
The vulnerability has been assigned a CVSS v4.0 base score of 8.7 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Under CVSS v3.1, it received a base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is associated with CWE-672 (Operation on a Resource after Expiration or Release) and CWE-825 (Expired Pointer Dereference) (NVD).
Impact
The vulnerability allows a remote, unauthenticated attacker to degrade the performance of the NGINX service until the master and worker processes are restarted. Continued degradation can escalate into a denial-of-service (DoS). The impact is restricted to the data plane, with no exposure of the control plane (CERT-EU).
Mitigation and workarounds
Organizations are advised to apply updates to the affected assets as soon as possible. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated (CERT-EU, NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management