> CVE-2024-7347 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2024-08-14 15:15
MODIFIED
2025-09-05 15:42
CVSS_SCORE V3
4.7
EPSS (Prob. Exploit)
0.32%
Top 74.8%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

> AFFECTED_PRODUCTS

F5 - Nginx Plus
>= r27 < r31
F5 - Nginx Plus
Version: r31
F5 - Nginx Plus
Version: r32
F5 - Nginx Open Source
>= 1.5.13 < 1.26.2
F5 - Nginx Open Source
Version: 1.27.0

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Local (L)
Exploit nécessite un accès local au système
AC (Complexité d'Attaque)
Attack Complexity
High (H)
Conditions spécifiques doivent être réunies pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
None (N)
Aucune divulgation d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
None
Aucune divulgation d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
High
Interruption totale du service possible

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: nginx security update
An update for nginx is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnera...
Red Hat Security Advisory: nginx:1.22 security update
An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate....
Red Hat Security Advisory: nginx:1.22 security update
An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate....
Red Hat Security Advisory: nginx:1.24 security update
An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate....
Red Hat Security Advisory: nginx security update
An update for nginx is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnera...
Red Hat Security Advisory: nginx security update
An update for nginx is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVS...
Red Hat Security Advisory: nginx:1.24 security update
An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Sco...
Red Hat Security Advisory: nginx:1.22 security update
An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Sco...

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
114 versions affected
ALIASES:
BIT-nginx-2024-7347, BIT-nginx-gateway-2024-7347

> HISTORIQUE DES MODIFICATIONS

Première apparition
14/08/2024 15:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:53
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME