Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-31144

Date: February 14, 2025

An issue was discovered in Xapi, where metadata injection attack could be performed against backup/restore functionality. A malicious guest can manipulate its disk to appear to be a metadata backup. To leverage the vulnerability, an attacker would likely need insider information to construct a plausible-looking metadata backup, and would have to persuade a real administrator to perform a data-recovery action. Systems running Xapi v1.249.x are affected.

Language: Python

Severity Score

Related Resources (7)

http://xenbits.xen.org/xsa/advisory-459.html
https://seclists.org/oss-sec/2024/q3/att-74/xsa459-xsconsole.patch
https://xenbits.xen.org/xsa/advisory-459.html
http://www.openwall.com/lists/oss-security/2024/07/16/4
https://nvd.nist.gov/vuln/detail/CVE-2024-31144
https://github.com/xapi-project/xsconsole/commit/54d9b4f4e78c04922d35e60c996b35906a2cadc5
https://www.mend.io/vulnerability-database/CVE-2024-31144

Severity Score

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us