Positive MaxPatrol 8/XSpider up to 09.2020 Service Port 2002 resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in Positive MaxPatrol 8 and XSpider up to 09.2020. Affected is an unknown function of the component Service Port 2002. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2021-4467. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Positive MaxPatrol 8 and XSpider up to 09.2020. It has been rated as critical. Affected by this issue is an unknown code block of the component Service Port 2002. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The service generates a new session identifier for each incoming connection without adequately limiting concurrent requests. An unauthenticated remote attacker can repeatedly issue HTTPS requests to the service, causing excessive allocation of session identifiers. Under load, session identifier collisions may occur, forcing active client sessions to disconnect and resulting in service disruption.

The weakness was published by AsCiI. The advisory is shared for download at vulners.com. This vulnerability is handled as CVE-2021-4467 since 11/14/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2021-34719). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Positive

Name

• MaxPatrol 8
• XSpider

Version

• 09.2020

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion