Vulnerability · Published May 16, 2022 · Assigned by @huntrdev
CVE-2022-1718The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk
High 7.2
In plain English
A high-severity integer overflow in polonel/trudesk from polonel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)1.1%top 35.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| polonel | polonel/trudesk | unspecified – before 1.2.2 |
Weakness: CWE-190 · Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://huntr.dev/bounties/1ff8afe4-6ff7-45aa-a652-d8aac7e5be7e x_refsource_CONFIRM
- https://github.com/polonel/trudesk/commit/87e231e04495fb705fe1e03cb56fc4136bafe895 x_refsource_MISC