CVE-2017-12784

{"id": "CVE-2017-12784", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-08-21T07:29:00.187", "references": [{"url": "https://drive.google.com/file/d/0B9DojFnTUSNGcG1WN2Q1eVZMQTg/view", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malformed request header with many '|' characters. NOTE: some sources use this ID for a NoviWare issue, but the correct ID for that issue is CVE-2017-12787."}, {"lang": "es", "value": "En Youngzsoft CCFile, tambi\u00e9n conocido como CC File Transfer, en su versi\u00f3n 3.6, es posible que un usuario malicioso bloquee el software afectado de forma remota mediante el env\u00edo de una petici\u00f3n HTTP manipulada. No se requiere autenticaci\u00f3n. Un payload de ejemplo es un encabezado de petici\u00f3n con formato incorrecto con muchos caracteres '|'."}], "lastModified": "2017-08-25T17:42:08.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ccfile:cc_file_transfer:3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E75F5A0-465C-4FE8-A030-441CA9CE5D1F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}