CVE-2020-13432 — HIGH (7.5)

Vulnerability Description

rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Rejetto	Http File Server	2.3m

Related Weaknesses (CWE)

CWE-120

References

http://hyp3rlinx.altervista.org/advisories/HFS-HTTP-FILE-SERVER-v2.3-REMOTE-BUFFExploitThird Party Advisory
http://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jun/13ExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/12
https://github.com/rejetto/hfs2/commit/b8ebfc4e22948e1a61506cd66e397b61ea5ea5dePatchThird Party Advisory
https://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300ExploitThird Party AdvisoryVDB Entry
https://www.rejetto.com/hfs/?f=wnRelease NotesVendor Advisory
http://hyp3rlinx.altervista.org/advisories/HFS-HTTP-FILE-SERVER-v2.3-REMOTE-BUFFExploitThird Party Advisory
http://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300-ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jun/13ExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/12
https://github.com/rejetto/hfs2/commit/b8ebfc4e22948e1a61506cd66e397b61ea5ea5dePatchThird Party Advisory
https://packetstormsecurity.com/files/157980/HFS-Http-File-Server-2.3m-Build-300ExploitThird Party AdvisoryVDB Entry
https://www.rejetto.com/hfs/?f=wnRelease NotesVendor Advisory

FAQ

What is CVE-2020-13432?

CVE-2020-13432 is a vulnerability with a CVSS score of 7.5 (HIGH). rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests w...

How severe is CVE-2020-13432?

CVE-2020-13432 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-13432?

Check the references section above for vendor advisories and patch information. Affected products include: Rejetto Http File Server.