PT-2023-11600 · Tdengine+1 · Tdengine+1

Publicado 2023-08-22 · Atualizado 2023-08-28 · CVE-2020-21699

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tengine version 2.2.2 Tengine versions 0.5.6 through 1.13.2

Description The web server is vulnerable to an integer overflow vulnerability in the nginx range filter module. This vulnerability results in the leakage of potentially sensitive information when triggered by specially crafted requests.

Recommendations For Tengine version 2.2.2, update to a version that is not based on the vulnerable Nginx range. For Tengine versions 0.5.6 through 1.13.2, consider disabling the nginx range filter module as a temporary workaround until a patch is available.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2020-21699

Produtos afetados

Nginx

Tdengine

Referências · 7

• 🔥 https://github.com/ZxDecide/Nginx-variants/blob/master/%E9%99%84%E4%BB%B6(Tengine).docx · Exploit
• https://github.com/ZxDecide/Nginx-variants/blob/master/%E9%99%84%E4%BB%B6%28Tengine%29.docx · Nota
• https://t.me/cvenotify/57097 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-21699 · Nota de Segurança
• https://t.me/cvenotify/57466 · Publicação no Telegram
• https://t.me/cibsecurity/68958 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2020-21699 · Aviso do Fabricante