CVE-2020-8867

2020-04-2220:51:07

CWE-367

zdi

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.018 Low

EPSS

Percentile

88.1%

JSON

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.

CNA Affected

[
  {
    "product": "UA .NET Standard",
    "vendor": "OPC Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.04.358.30"
      }
    ]
  }
]