Vulnerability Details : CVE-2020-15100
In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
Exploit prediction scoring system (EPSS) score for CVE-2020-15100
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 10 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-15100
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST |
|
3.3
|
LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
1.8
|
1.4
|
NIST |
|
2.8
|
LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
1.3
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2020-15100
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: security-advisories@github.com (Secondary)
-
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-15100
-
https://github.com/schokokeksorg/freewvs/security/advisories/GHSA-9cfv-9463-8gqv
Denial of service through large files · Advisory · schokokeksorg/freewvs · GitHubThird Party Advisory
-
https://github.com/schokokeksorg/freewvs/commit/18bbf2043e53f69e0119d24f8ae4edb274afb9b2
limit data we read from file to avoid DoS via large files · schokokeksorg/freewvs@18bbf20 · GitHubPatch;Third Party Advisory
Products affected by CVE-2020-15100
- cpe:2.3:a:schokokeks:freewvs:*:*:*:*:*:*:*:*