PT-2018-10129 · Litecart · Litecart

Mschop · Published 2018-05-09 · Updated 2018-06-12 · CVE-2018-10827

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.1.2

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending requests for URIs that do not exist. This is because the not found.log file in the public html/logs directory grows without bound as it logs each non-existent URI request, and this log file is loaded into memory for each request.

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the not found.log file or implementing a log rotation mechanism to prevent the file from growing without bound.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-10827

Affected Products

Litecart

References · 3

• https://github.com/litecart/litecart/issues/119 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-10827 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10827 · Vendor Advisory