Security Resilience

CVE-2024-23639

Objectcomputing Micronaut ≤ 3.8.3

Published
09 February 2024
Modified
17 June 2026
CVSS Score v3.1 5.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0026 17th percentile
Risk Priority 40 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-23639 is a medium-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Objectcomputing Micronaut. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Winlogon Helper DLL (T1547.004); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A02:2025 Security MisconfigurationA05:2025 Injection

EU & UK References

Vulnerability Data

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not…

more

typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.

CWE(s)
CWE-15CWE-610CWE-664

Related Threats

MITRE ATT&CK Enterprise Techniques

T1547.004 Winlogon Helper DLL Persistence
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
attack.mitre.org →
T1574.006 Dynamic Linker Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-33013Same product: Objectcomputing Micronaut
CVE-2026-33012Same product: Objectcomputing Micronaut
CVE-2023-32076Shared CWE-15, CWE-610
CVE-2023-6154Shared CWE-15, CWE-610
CVE-2026-30816Shared CWE-15, CWE-610
CVE-2023-4704Shared CWE-15, CWE-610
CVE-2026-0418Shared CWE-15, CWE-610
CVE-2026-30817Shared CWE-15, CWE-610
CVE-2024-10979Shared CWE-15, CWE-610
CVE-2023-23932Same vendor: Objectcomputing

Affected Assets

objectcomputing
micronaut
≤ 3.8.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces approved authorizations for logical access to configuration resources so external parties cannot alter them.

CM-5 Access Restrictions for Change good match

Enforces documented access restrictions on all changes to system configuration, directly blocking unauthorized external control of settings.

AC-4 Information Flow Enforcement good match

Controls information flow between security domains, blocking resolution of external references to unintended spheres.

AC-6 Least Privilege good match

Limits privileges to the minimum needed, reducing the set of users who can externally modify configuration.

SI-10 Information Input Validation good match

Validates information inputs, directly stopping externally controlled names or references from being accepted.

SC-39 Process Isolation partial match

SC-39 enforces separate execution domains so one process cannot corrupt or misuse another process's resources across their lifetimes.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.RA-07 partial match
blocks

Formal change and exception management catches externally driven configuration alterations.

PR.AA-05 partial match
blocks

Least-privilege access policies reduce unauthorized external modification of configuration values.

PR.PS-01 partial match
blocks

Hardened configuration baselines and change controls directly limit external manipulation of settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
blocks

A.5.15 only requires that access control policies and rules be defined and documented; it does not itself enforce, implement or configure those rules to stop external control of system/configuration settings, so the weakness remains fully exploitable.

A.5.18 Access rights partial match
blocks

A.5.18 governs the provisioning, review, and revocation of authorized access rights; it has no bearing on whether a system or configuration setting can be externally controlled by a user (CWE-15).

A.5.37 Documented operating procedures partial match
degrades

Documented operating procedures define how configuration changes must be performed.

A.7.9 Security of assets off-premises partial match
removes
A.8.10 Information deletion partial match
blocks

Information deletion control ensures proper release and sanitization at end of life.

A.8.18 Use of privileged utility programs partial match
blocks

Use of privileged utility programs is controlled to prevent misuse of configuration tools.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-610, a class-level weakness, and none of its children carries one either.
  • No fine-grained STIG row for CWE-664, a pillar-level weakness. Rules are authored against its narrower children: CWE-471.

References