Vulnerability · Published Aug 2, 2022 · Assigned by twcert

CVE-2022-35220TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1

High 7.7

In plain English

A high-severity resource allocation without limits in Teamplus Pro from TEAMPLUS TECHNOLOGY INC.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this client’s Teamplus Pro application.

Affected products (as reported)

Vendor	Product	Versions
TEAMPLUS TECHNOLOGY INC.	Teamplus Pro	unspecified – through 3.011.6.0.1
TEAMPLUS TECHNOLOGY INC.	Teamplus Pro	unspecified – through 3.011.6.0.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References

https://www.twcert.org.tw/tw/cp-132-6359-f5d1c-1.html x_refsource_MISC