Lucene search

[email protected]NVD:CVE-2020-28873

HistoryMar 17, 2021 - 1:15 p.m.

CVE-2020-28873

2021-03-1713:15:14

CWE-916

[email protected]

web.nvd.nist.gov

fluxbb vulnerability

denial of service

long password attack

cpu exhaustion

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.6%

JSON

Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.

Affected configurations

Nvd

Node

fluxbbfluxbbMatch1.5.11

VendorProductVersionCPE
fluxbbfluxbb1.5.11cpe:2.3:a:fluxbb:fluxbb:1.5.11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fluxbb	fluxbb	1.5.11	cpe:2.3:a:fluxbb:fluxbb:1.5.11:::::::*

References

fluxbb.com

www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.6%

JSON

Related for NVD:CVE-2020-28873

cvelist1 prion1 cve1