CVE-2019-25666
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
SpotAuditor 3.6.7 has a local buffer overflow in the Base64 Password Decoder component. An attacker can supply an oversized Base64 string to crash the application.
Risk Assessment
An attacker can cause a denial of service (DoS) of the application, preventing its operation.
Recommendation
Update SpotAuditor to a newer version if available, or restrict access to the Base64 decoder.
Other vulnerabilities in SpotAuditor
See all- CVE-2019-25434High
A denial of service vulnerability in SpotAuditor 5.3.1.0 allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Entering a string of 5000 bytes or more triggers an unhandled exception that crashes the application.
- CVE-2021-27722Medium
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
Original NVD description (English source)
SpotAuditor 3.6.7 contains a local buffer overflow vulnerability in the Base64 Password Decoder component that allows attackers to crash the application. Attackers can supply an oversized Base64 string through the decoder interface to trigger a denial of service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS