luelista miniConf up to 1.7.6 URL Scanning miniConf/MessageView.cs denial of service

EntryHistoryDiffjsonxmlCTI

A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. The CWE definition for the vulnerability is CWE-404. The weakness was published 01/07/2023 as c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2015-10025. Access to the local network is required for this attack to succeed. Technical details are available. There is no exploit available. The pricing for an exploit might be around USD $0-$5k at the moment. It is declared as not defined. We expect the 0-day to have been worth approximately $0-$5k. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. The bugfix is ready for download at github.com. It is recommended to upgrade the affected component. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	47

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_meta_basescore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss3_nvd_basescore	1
vulnerability_cvss2_nvd_basescore	1

Commit Conf

90%	35
70%	25
50%	14

Approve Conf

90%	35
70%	25
80%	14

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
13608412	01/29/2023	VulD...	cvss3_cna_basescore	3.5	see CVSS documentation	01/29/2023	accepted	90
13608411	01/29/2023	VulD...	cvss3_nvd_basescore	7.5	nist.gov	01/29/2023	accepted	90
13608410	01/29/2023	VulD...	cvss2_nvd_basescore	2.3	nist.gov	01/29/2023	accepted	90
13608409	01/29/2023	VulD...	cvss3_meta_tempscore	4.8	see CVSS documentation	01/29/2023	accepted	90
13608408	01/29/2023	VulD...	cvss3_meta_basescore	4.8	see CVSS documentation	01/29/2023	accepted	90
13608407	01/29/2023	VulD...	cve_cna	VulDB	nvd.nist.gov	01/29/2023	accepted	70
13608406	01/29/2023	VulD...	cvss3_cna_a	L	nvd.nist.gov	01/29/2023	accepted	70
13608405	01/29/2023	VulD...	cvss3_cna_i	N	nvd.nist.gov	01/29/2023	accepted	70
13608404	01/29/2023	VulD...	cvss3_cna_c	N	nvd.nist.gov	01/29/2023	accepted	70
13608403	01/29/2023	VulD...	cvss3_cna_s	U	nvd.nist.gov	01/29/2023	accepted	70
13608402	01/29/2023	VulD...	cvss3_cna_ui	N	nvd.nist.gov	01/29/2023	accepted	70
13608401	01/29/2023	VulD...	cvss3_cna_pr	L	nvd.nist.gov	01/29/2023	accepted	70
13608400	01/29/2023	VulD...	cvss3_cna_ac	L	nvd.nist.gov	01/29/2023	accepted	70
13608399	01/29/2023	VulD...	cvss3_cna_av	A	nvd.nist.gov	01/29/2023	accepted	70
13608398	01/29/2023	VulD...	cvss2_nvd_ai	P	nvd.nist.gov	01/29/2023	accepted	70
13608397	01/29/2023	VulD...	cvss2_nvd_ii	N	nvd.nist.gov	01/29/2023	accepted	70
13608396	01/29/2023	VulD...	cvss2_nvd_ci	N	nvd.nist.gov	01/29/2023	accepted	70
13608395	01/29/2023	VulD...	cvss2_nvd_au	S	nvd.nist.gov	01/29/2023	accepted	70
13608394	01/29/2023	VulD...	cvss2_nvd_ac	M	nvd.nist.gov	01/29/2023	accepted	70
13608393	01/29/2023	VulD...	cvss2_nvd_av	A	nvd.nist.gov	01/29/2023	accepted	70