7.5

CVE-2020-8815

Exploit
Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iktm ≫ Bearftp Version < 0.3.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.19% 0.801
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/kolya5544/BearFTP
Third Party Advisory
https://github.com/kolya5544/BearFTP/blob/f5a8047587c1a96456d4f291c12b038b9ab0d0c5/BearFTP/Program.cs#L503-L525
Third Party Advisory
Exploit
https://github.com/kolya5544/BearFTP/commit/17a6ead72d4a25cbfcef5e27613aa0a5f88a4b26
Patch
Third Party Advisory
https://github.com/kolya5544/BearFTP/commit/66dc9d95e58bca133f265457d32007cdf38b66ad
Patch
Third Party Advisory
https://github.com/kolya5544/BearFTP/releases/tag/0.4.0
Third Party Advisory
Release Notes