Lucene search

GitHub Advisory DatabaseGHSA-FQFG-C577-2VC3

HistorySep 30, 2022 - 12:00 a.m.

rdiffweb's unlimited length Fullname field can lead to DoS

2022-09-3000:00:20

CWE-770

GitHub Advisory Database

github.com

rdiffweb

fullname

dos

email validation

denial of service

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

37.9%

JSON

rdiffweb prior to 2.5.0a3 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to overload.

Affected configurations

Vulners

Node

rdiffwebrdiffwebRange<2.5.0a3

VendorProductVersionCPE
rdiffwebrdiffweb*cpe:2.3:a:rdiffweb:rdiffweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rdiffweb	rdiffweb	*	cpe:2.3:a:rdiffweb:rdiffweb::::::::

References

github.com/advisories/GHSA-fqfg-c577-2vc3

github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7

github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-298.yaml

huntr.dev/bounties/e70ad507-1424-463b-bdf1-c4a6fbe6e720

nvd.nist.gov/vuln/detail/CVE-2022-3364

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

37.9%

JSON

Related for GHSA-FQFG-C577-2VC3