Lucene search

[email protected]CVE-2020-11018

HistoryMay 29, 2020 - 5:15 p.m.

CVE-2020-11018

2020-05-2917:15:11

CWE-125

[email protected]

web.nvd.nist.gov

155

cve

2020

11018

freerdp

resource exhaustion

vulnerability

fixed

2.1.0

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

29.0%

JSON

In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0.

Affected configurations

Vulners

NVD

Node

freerdpfreerdpRange≤2.0.0

VendorProductVersionCPE
freerdpfreerdp*cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
freerdp	freerdp	*	cpe:2.3:a:freerdp:freerdp::::::::

CNA Affected

[
  {
    "vendor": "FreeRDP",
    "product": "FreeRDP",
    "versions": [
      {
        "version": "<= 2.0.0",
        "status": "affected"
      }
    ]
  }
]