PT-2018-10129 · Litecart · Litecart

Mschop · Publicado 2018-05-09 · Atualizado 2018-06-12 · CVE-2018-10827

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.1.2

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending requests for URIs that do not exist. This is because the not found.log file in the public html/logs directory grows without bound as it logs each non-existent URI request, and this log file is loaded into memory for each request.

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the not found.log file or implementing a log rotation mechanism to prevent the file from growing without bound.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-10827

Produtos afetados

Litecart

Referências · 3

• https://github.com/litecart/litecart/issues/119 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-10827 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10827 · Aviso do Fabricante