Vulnerability Description
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerability that leads to both local and remote code (via RPC) execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Morganstanley | Hobbes | <= 2020-05-21 |
Related Weaknesses (CWE)
References
- https://know.bishopfox.com/advisories/oob-to-rce-exploitation-of-the-hobbes-funcExploitTechnical DescriptionThird Party Advisory
- https://know.bishopfox.com/advisories/oob-to-rce-exploitation-of-the-hobbes-funcExploitTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2020-13656?
CVE-2020-13656 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerability that leads to both local and remot...
How severe is CVE-2020-13656?
CVE-2020-13656 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-13656?
Check the references section above for vendor advisories and patch information. Affected products include: Morganstanley Hobbes.