CVE-2024-20380
Assigner: cisco
Published: 2024-04-18T19:19:21.423Z
State: PUBLISHED
title: ClamAV HTML Parser Denial of Service Vulnerability
datePublic: 2024-04-18T18:00:00.000Z
problemTypes: descriptions: cweId: CWE-475
description: CWE-475: Undefined Behavior for Input to API
type: CWE
affected: vendor: Cisco
product: ClamAV
versions: status: affected
version:  1.3
defaultStatus: unaffected
descriptions: value: A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
source: discovery: EXTERNAL