CVE-2024-1672
Fedoraproject Fedora 38 … 39
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-1672 is a medium-severity Use of Function with Inconsistent Implementations (CWE-474) vulnerability in Fedoraproject Fedora. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique DCSync (T1003.006); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17407
Vulnerability Data
Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing across OS versions can reveal behavioral differences caused by the inconsistent function.
Documented development standards and tools can prohibit or replace functions known to have inconsistent implementations.
Engineering principles can require use of portable, consistently implemented functions across platforms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce coding standards and portability reviews that avoid functions with inconsistent behavior across platforms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC requires consistent API selection and platform abstraction, reducing use of inconsistently implemented functions.
Secure coding standards explicitly prohibit or wrap functions known to behave differently across OSes and versions.
Security testing can surface cross-platform inconsistencies but does not prevent their introduction in code.