CVE-2024-29133

🔶 medium

Summary

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

CVSS Score

5.4

Medium

EPSS Score

0.7

Exploit Probability

Published Date

2024-03-21

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.6% of all 338,292 vulnerabilities in our database.

#261,731

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Mar 29, 2024

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Gary Gregory

SSVC data provided by CISA

Last Modified 2025-05-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-787

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
fedoraproject	fedora	Affected	v39
fedoraproject	fedora	Affected	v40
apache	commons_configuration	Affected	≥ 2.0 < 2.10.1

🔗 References 4

http://www.openwall.com/lists/oss-security/2024/03/20/3

Mailing List Third Party Advisory

https://lists.apache.org/thread/ccb9w15bscznh6tnp3ws...

Mailing List Vendor Advisory

https://lists.fedoraproject.org/archives/list/packag...

Third Party Advisory

https://lists.fedoraproject.org/archives/list/packag...

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-54230	⚠️ high	7.0	0.1	A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr...	2026-06-13
CVE-2026-54231	🔶 medium	5.5	0.1	A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script...	2026-06-13
CVE-2026-45205	🔶 medium	5.3	0.1	Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Config...	2026-05-14
CVE-2026-35093	⚠️ high	8.8	0.2	A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or ...	2026-04-01
CVE-2026-35094	ℹ️ low	3.3	0.0	A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can expl...	2026-04-01
CVE-2025-46392	🔶 medium	6.5	0.4	Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Ap...	2025-05-09

These CVEs affect the same products