CVE-2018-25244
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a search operation.
Risk Assessment
The risk is that a local user can intentionally crash the application, potentially causing loss of unsaved data and disrupting operations.
Recommendation
It is recommended to update Eco Search to the latest version that includes a fix limiting input length or implementing input validation.
Original NVD description (English source)
Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a search operation.