Providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID.
GET http://localhost:8055/utils/random/string
GET http://localhost:8055/utils/random/string?length=foo
GET http://localhost:8055/utils/random/string
will return an empty string instead of a random stringThis counts as an unauthenticated denial of service attack vector so this impacts all unpatched instances reachable over the internet.
{ "nvd_published_at": "2024-06-03T15:15:09Z", "cwe_ids": [ "CWE-754" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-06-04T17:53:29Z" }