CVE-2019-25434
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A denial of service vulnerability in SpotAuditor 5.3.1.0 allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Entering a string of 5000 bytes or more triggers an unhandled exception that crashes the application.
Risk Assessment
The risk is that an attacker can easily and remotely perform a DoS attack without authentication, potentially causing service disruption and system unavailability for users.
Recommendation
Immediately update SpotAuditor to the latest version that includes a fix for this vulnerability. If an update is not available, restrict access to the registration function or implement input length validation mechanisms.
Other vulnerabilities in SpotAuditor
See all- CVE-2019-25666Medium
SpotAuditor 3.6.7 has a local buffer overflow in the Base64 Password Decoder component. An attacker can supply an oversized Base64 string to crash the application.
- CVE-2021-27722Medium
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
Original NVD description (English source)
SpotAuditor 5.3.1.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Attackers can enter a large string of characters (5000 bytes or more) in the name field during registration to trigger an unhandled exception that crashes the application.