Lucene search

MitreCVE-2020-28873

HistoryMar 17, 2021 - 1:15 p.m.

CVE-2020-28873

2021-03-1713:15:14

CWE-916

mitre

web.nvd.nist.gov

fluxbb

1.5.11

dos

denial of service

vulnerability

long password

cpu exhaustion

memory exhaustion

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

45.6%

JSON

Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.

Affected configurations

Nvd

Node

fluxbbfluxbbMatch1.5.11

VendorProductVersionCPE
fluxbbfluxbb1.5.11cpe:2.3:a:fluxbb:fluxbb:1.5.11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fluxbb	fluxbb	1.5.11	cpe:2.3:a:fluxbb:fluxbb:1.5.11:::::::*

References

fluxbb.com

www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

45.6%

JSON

Related for CVE-2020-28873