{"id":"CVE-2024-45526","published":"2024-10-22T00:00:00Z","modified":"2024-10-23T18:32:55Z","title":"An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00504,"percentile":0.42951,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-45526.pdf","tags":[]}],"priority":{"score":12.3,"factors":[{"name":"EPSS percentile","points":8.59},{"name":"CVSS severity","points":3.71}]},"affected":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua","vulnerableRanges":["<1.5.374.118"],"patched":["1.5.374.118"],"from":["GHSA-7vfh-cqpc-4267"],"provenance":"source"},{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","vulnerableRanges":["<1.5.374.118"],"patched":["1.5.374.118"],"from":["GHSA-7vfh-cqpc-4267"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2986","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opcfoundation-netstandard-opc-ua-core-cve-2024-33862","packageHistory":[{"cve":"CVE-2022-29866","published":"2022-06-16","fixed":"1.4.368.58","kev":false},{"cve":"CVE-2023-31048","published":"2023-12-12","fixed":"1.4.371.86","kev":false},{"cve":"CVE-2024-33862","published":"2024-07-05","fixed":"1.5.374.54","kev":false,"link":{"from":"CVE-2024-33862","to":"CVE-2024-45526","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core","fromFixed":"1.5.374.54","toFixed":"1.5.374.118","daysApart":109},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]}},{"cve":"CVE-2024-45526","published":"2024-10-22","fixed":"1.5.374.118","kev":false},{"cve":"CVE-2024-42512","published":"2025-02-10","fixed":"1.5.374.158","kev":false,"link":{"from":"CVE-2024-45526","to":"CVE-2024-42512","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core","fromFixed":"1.5.374.118","toFixed":"1.5.374.158","daysApart":111}]}}],"package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core"}}