CVE-2020-28873

{"id": "CVE-2020-28873", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-03-17T13:15:14.937", "references": [{"url": "http://fluxbb.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server."}, {"lang": "es", "value": "Fluxbb versi\u00f3n 1.5.11, est\u00e1 afectado por una vulnerabilidad de denegaci\u00f3n de servicio (DoS) al enviar una contrase\u00f1a extremadamente larga por medio del formulario de inicio de sesi\u00f3n del usuario. Cuando es enviada una contrase\u00f1a larga, el proceso de hash de contrase\u00f1a dar\u00e1 como resultado el agotamiento de la CPU y la memoria en el servidor"}], "lastModified": "2023-11-07T03:21:24.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluxbb:fluxbb:1.5.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4294CBC2-85BA-4C0F-90D3-E655F78495DF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}