CVE-2019-25659
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
ASPRunner Professional 6.0.766 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long project name. Attackers can paste 180 or more characters into the Project name field during project creation to trigger an application crash.
Risk Assessment
A local attacker can crash the application, leading to denial of service. Potential code execution in the application context is also possible.
Recommendation
Update ASPRunner Professional to a patched version or restrict project name length in configuration.
Original NVD description (English source)
ASPRunner Professional 6.0.766 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long project name. Attackers can paste 180 or more characters into the Project name field during project creation to trigger an application crash.