6.5

CVE-2018-14055

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Znc ≫ Znc Version <= 1.7.0
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.702
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e
Patch
Third Party Advisory
https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201807-03
Third Party Advisory
https://www.debian.org/security/2018/dsa-4252
Third Party Advisory