How severe is CVE-2024-10372?

CVE-2024-10372 has a CVSS 3.x base score of 4.5, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-10372 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-10372?

CVE-2024-10372 affects Chidiwilliams Buzz. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-10372?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-10372 have an EU (EUVD) identifier?

Yes. CVE-2024-10372 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33069.

When was CVE-2024-10372 published?

CVE-2024-10372 was published on 2024-10-25 and last updated on 2026-06-17.

CVE-2024-10372

CVE-2024-10372 is a medium-severity vulnerability in Chidiwilliams Buzz with a CVSS 3.x base score of 4.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-377.

Key facts

Severity: Medium (CVSS 3.x base score 4.5)
CVSS v2: 3.5
CVSS v4: 2.0
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-33069
Weakness: CWE-377
Affected product: Chidiwilliams Buzz
Published: 2024-10-25
Last modified: 2026-06-17

Description

A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Frequently asked questions

What is CVE-2024-10372?: A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
How severe is CVE-2024-10372?: CVE-2024-10372 has a CVSS 3.x base score of 4.5, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-10372 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-10372?: CVE-2024-10372 affects Chidiwilliams Buzz. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-10372?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-10372 have an EU (EUVD) identifier?: Yes. CVE-2024-10372 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33069.
When was CVE-2024-10372 published?: CVE-2024-10372 was published on 2024-10-25 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:chidiwilliams:buzz:1.1.0:*:*:*:*:*:*:*

Other CWE-377 (Insecure Temporary File) vulnerabilities

CVE-2011-4119 — Critical (CVSS 9.8): caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
CVE-2012-2666 — Critical (CVSS 9.8): golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a…
CVE-2015-5224 — Critical (CVSS 9.8): The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name…
CVE-2025-14307 — High (CVSS 8.1): An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The…
CVE-2023-43498 — High (CVSS 8.1): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates…
CVE-2025-46369 — High (CVSS 7.8): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File…

Browse all CWE-377 (Insecure Temporary File) vulnerabilities →