CVE-2024-7347
mediumPriorität · verfolgen · 19EPSS 0.003 · 25. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.9–5.7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (39)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-1863NGINX und NGINX Plus: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-08-14csaf · cert_bundDE
Ein entfernter, anonymer oder ein lokaler Angreifer kann mehrere Schwachstellen in NGINX NGINX Plus und NGINX ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-nginx-2024-7347NGINX MP4 module vulnerability2024-08-16vendor · osvUS
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- BIT-nginx-gateway-2024-7347NGINX MP4 module vulnerability2025-12-03vendor · osvUS
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202408-1202cnnvd
- EUVD-2024-48285enisa_euvd
- BDU:2024-06605fstec_bdu
- GHSA-3r23-64c4-mj87enisa_euvd
- BIT-nginx-2024-7347osv
- BIT-nginx-gateway-2024-7347osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-7347cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-7347/cnnvd
- https://my.f5.com/manage/s/article/K000140529cnnvd
- https://vigilance.fr/vulnerability/nginx-denial-of-service-via-ngx-cnnvd
- https://my.f5.com/manage/s/article/K000140529enisa_euvd
- http://www.openwall.com/lists/oss-security/2024/08/14/4Mailing Listnvd
- https://lists.debian.org/debian-lts-announce/2025/03/msg00017.htmlnvd
- https://my.f5.com/manage/s/article/K000140529Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan