CVE-2021-34584
Assigner: CERTVDE
Published: 2021-10-25T00:00:00
State: PUBLISHED
affected: product: CODESYS V2
vendor: CODESYS
versions: lessThan: V1.1.9.22
status: affected
version: all web servers
versionType: custom
credits: value: This vulnerability was discovered by Tenable Research.
datePublic: 2021-10-25T00:00:00
descriptions: value: Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-126
description: CWE-126 Buffer Over-read
type: CWE
solutions: value: CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68.
source: discovery: EXTERNAL
title: CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)
x_generator: engine: Vulnogram 0.0.9