Read the docs
TI-2024-09583 Aliases CVE-2024-10345GHSA-33p9-j27p-6f2h

Unauthenticated Denial of Service via Shutdown Function

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0049 42nd percentileScored 2026-11-07
Fix Fixed Helix Core (Helix): 2024.2, 2024.1, 2023.2 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforceHelix Core0.0.0 to before 2024.2; 0.0.0 to before 2024.1; 0.0.0 to before 2023.2; 0.0.0 to before 2023.1; 0.0.0 to before 2022.22024.2, 2024.1, 2023.2, 2023.1, 2022.2Patch availableCNA
  • Helix Core VendorPerforce Affected 0.0.0 to before 2024.2; 0.0.0 to before 2024.1; 0.0.0 to before 2023.2; 0.0.0 to before 2023.1; 0.0.0 to before 2022.2 Fixed in 2024.2, 2024.1, 2023.2, 2023.1, 2022.2 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:*not specified by CISA-ADP—Perforce
  • cpe:2.3:a:perforce:helix_core:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Perforce

Remediation

  • Fix · CNA Helix Core (Helix) Fixed in 2024.2, 2024.1, 2023.2, 2023.1, 2022.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Helix Core 2022.2, 2023.1 and 3 more versions

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-09582 Unauthenticated Denial of Service via Refuse FunctionPriority MEDIUM 44
    • TI-2024-09556 Unauthenticated Denial of Service via Auto Generation FunctionPriority MEDIUM 44
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10345
  2. 2026-10-03 Alias added: GHSA-33p9-j27p-6f2h

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences