7.5

CVE-2020-11650

An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ixsystems ≫ Freenas Firmware Version 11.2 Update -
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u2
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u2.1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u3
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u4
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u4.1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u5
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u5.1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u6
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u6.1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.2 Update u7
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update -
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update alpha1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update alpha2
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update beta1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update rc1
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Freenas Firmware Version 11.3 Update rc2
   Ixsystems ≫ Freenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update -
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u2
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u2.1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u3
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u4
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u4.1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u5
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u5.1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u6
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u6.1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.2 Update u7
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update -
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update alpha1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update alpha2
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update beta1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update rc1
   Ixsystems ≫ Truenas Version -
Ixsystems ≫ Truenas Firmware Version 11.3 Update rc2
   Ixsystems ≫ Truenas Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.95% 0.854
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

https://jira.ixsystems.com/browse/NAS-104748
Patch
Third Party Advisory
https://security.ixsystems.com/cves/2020-04-08-cve-2020-11650/
Vendor Advisory