ByteOS Network

NVD Vulnerability Details :

CVE-2020-8859

Analyzed

Source-zdi-disclosures@trendmicro.com

Published At-23 Mar, 2020 | 21:15

Updated At-26 Mar, 2020 | 15:50

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition. Was ZDI-CAN-10115.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary	3.0	5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P

CPE Matches

psi>>electronic_logbook>>3.1.4-283534d

cpe:2.3:a:psi:electronic_logbook:3.1.4-283534d:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-476	Primary	nvd@nist.gov
CWE-476	Secondary	zdi-disclosures@trendmicro.com

References

Hyperlink	Source	Resource
https://elog.psi.ch/elogs/Forum/69114	zdi-disclosures@trendmicro.com	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-252/	zdi-disclosures@trendmicro.com	Third Party Advisory VDB Entry

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History