PT-2021-11589 · Fluxbb · Fluxbb

Published 2021-03-17 · Updated 2021-03-22 · CVE-2020-28873

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Fluxbb version 1.5.11

Description: The issue is a denial of service (DoS) vulnerability that can be triggered by sending an extremely long password via the user login form. This causes CPU and memory exhaustion on the server due to the password hashing process.

Recommendations: For Fluxbb version 1.5.11, consider temporarily restricting the length of passwords that can be submitted through the user login form to prevent CPU and memory exhaustion until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2020-28873

Affected Products

Fluxbb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-28873 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28873 · Vendor Advisory
• https://acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation · Note
• https://t.me/cvenotify/11469 · Telegram Post
• https://t.me/cibsecurity/25013 · Telegram Post
• http://fluxbb.com · Note