CVE-2024-23639
micronaut-core management endpoints vulnerable to drive-by localhost attack
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Weakness
- CWE-15: External Control of System or Configuration Setting (opens in a new tab)All about CWE-15 and its CVEs
- CWE-664: Improper Control of a Resource Through its Lifetime (opens in a new tab)All about CWE-664 and its CVEs
- CWE-610: Externally Controlled Reference to a Resource in Another Sphere (opens in a new tab)All about CWE-610 and its CVEs
Affected products
micronaut-projects · micronaut-core
- affected < 3.8.3
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenio.micronaut:micronaut-http-serverGHSA-583g-g682-crxf (opens in a new tab)
- Mavenio.micronaut:micronaut-http-server-nettyGHSA-583g-g682-crxf (opens in a new tab)
- Mavenio.micronaut:micronaut-http-server-tckGHSA-583g-g682-crxf (opens in a new tab)
References (2)
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-583g-g682-crxf (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-583g-g682-crxf (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-23639)Record last updated .