CVE-2020-28873
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.
Risk Assessment
This attack can cause service unavailability, leading to downtime and potential financial losses.
Recommendation
Update Fluxbb to the latest version and limit the maximum password length in the login form.
Other vulnerabilities in Fluxbb
See all- CVE-2014-9574High
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
- CVE-2014-10029High
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
- CVE-2021-43677Medium
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
Original NVD description (English source)
Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.