7.5

CVE-2018-12680

Exploit
The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Coapthon Project ≫ Coapthon Version 3.1
Coapthon Project ≫ Coapthon Version 4.0.0
Coapthon Project ≫ Coapthon Version 4.0.1
Coapthon Project ≫ Coapthon Version 4.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.5% 0.716
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://github.com/Tanganelli/CoAPthon/issues/135
Third Party Advisory
Exploit
Issue Tracking