Vulnerabilities > CVE-2020-5243 - Unspecified vulnerability in Uap-Core Project Uap-Core

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

uap-core-project

NVD

Published: 2020-02-21

Updated: 2024-11-21

Summary

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

Vulnerable Configurations

Part	Description	Count
Application	Uap-Core_Project UAP Core Project UAP Core 0.1.0 UAP Core Project UAP Core 0.1.1 UAP Core Project UAP Core 0.1.2 UAP Core Project UAP Core 0.2.0 UAP Core Project UAP Core 0.2.1 UAP Core Project UAP Core 0.2.2 UAP Core Project UAP Core 0.2.3 UAP Core Project UAP Core 0.2.4 UAP Core Project UAP Core 0.3.0 UAP Core Project UAP Core 0.3.1 UAP Core Project UAP Core 0.3.2 UAP Core Project UAP Core 0.3.4 UAP Core Project UAP Core 0.4.0 UAP Core Project UAP Core 0.5.0 UAP Core Project UAP Core 0.6.0 UAP Core Project UAP Core 0.6.1 UAP Core Project UAP Core 0.6.2 UAP Core Project UAP Core 0.6.3 UAP Core Project UAP Core 0.6.4 UAP Core Project UAP Core 0.6.5 UAP Core Project UAP Core 0.6.6 UAP Core Project UAP Core 0.6.7 UAP Core Project UAP Core 0.6.8 UAP Core Project UAP Core 0.6.9 UAP Core Project UAP Core 0.6.11 UAP Core Project UAP Core 0.7.0 UAP Core Project UAP Core 0.7.1 UAP Core Project UAP Core 0.7.2	28

Summary

Vulnerable Configurations

References