CVE-2020-13128

An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/manolo/gwtupload/issues/33	Exploit Third Party Advisory
https://logicaltrust.net/blog/2020/02/gwt-upload.html	Exploit Third Party Advisory
https://github.com/manolo/gwtupload/issues/33	Exploit Third Party Advisory
https://logicaltrust.net/blog/2020/02/gwt-upload.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gwtupload_project:gwtupload:1.0.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-05-18 00:15

Updated : 2024-11-21 05:00

NVD link : CVE-2020-13128

Mitre link : CVE-2020-13128

CVE.ORG link : CVE-2020-13128

JSON object : View

Products Affected

gwtupload_project

gwtupload

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2020-13128", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-05-18T00:15:11.547", "references": [{"url": "https://github.com/manolo/gwtupload/issues/33", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://logicaltrust.net/blog/2020/02/gwt-upload.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/manolo/gwtupload/issues/33", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://logicaltrust.net/blog/2020/02/gwt-upload.html", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Manolo GWTUpload versi\u00f3n 1.0.3. El archivo server/UploadServlet.java (el servlet para manejar la carga de archivos) acepta un par\u00e1metro delay que causa que un subproceso (hilo) se suspenda. Esto puede ser abusado para causar que todos los subprocesos (hilos) de un servidor se suspendan, conllevando a una denegaci\u00f3n de servicio."}], "lastModified": "2024-11-21T05:00:42.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gwtupload_project:gwtupload:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83DF83B6-87E9-4C19-8616-59B0CE2A0364"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}