CVE-2020-36946 — HIGH (7.5)

Vulnerability Description

SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Flexense	Syncbreeze	10.0.28

Related Weaknesses (CWE)

CWE-770

References

http://www.syncbreeze.comProduct
https://www.exploit-db.com/exploits/49291ExploitThird Party Advisory
https://www.vulncheck.com/advisories/syncbreeze-login-denial-of-serviceThird Party Advisory
https://www.exploit-db.com/exploits/49291ExploitThird Party Advisory

FAQ

What is CVE-2020-36946?

CVE-2020-36946 is a vulnerability with a CVSS score of 7.5 (HIGH). SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to o...

How severe is CVE-2020-36946?

CVE-2020-36946 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-36946?

Check the references section above for vendor advisories and patch information. Affected products include: Flexense Syncbreeze.