CVE-2022-31005
Assigner: GitHub_M
Published: 2022-05-31T19:35:11
State: PUBLISHED
affected: product: vapor
vendor: vapor
versions: status: affected
version: < 4.60.3
descriptions: value: Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-190
description: CWE-190: Integer Overflow or Wraparound
type: CWE
source: advisory: GHSA-vj2m-9f5j-mpr5
discovery: UNKNOWN
title: Integer Overflow in Vapor's HTTP Range Request