En resumen
- CVE-2024-11043 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a invokeai.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.72%, mayor que el 53.9% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
| Package | Affected versions | Patched versions |
|---|
| invokeai PyPI | ≤ 5.0.2
| No fix yet |
Description
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.
NVD description
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free