CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/litespeedtech/openlitespeed/issues/117	Exploit Third Party Advisory
https://github.com/litespeedtech/openlitespeed/issues/117	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:litespeedtech:openlitespeed::::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:-::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc1::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc2::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc3::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc4::::::
	cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc5::::::

History

21 Nov 2024, 03:58

Type	Values Removed	Values Added
References	~~() https://github.com/litespeedtech/openlitespeed/issues/117 - Exploit, Third Party Advisory~~	() https://github.com/litespeedtech/openlitespeed/issues/117 - Exploit, Third Party Advisory

Information

Published : 2018-12-03 06:29

Updated : 2024-11-21 03:58

NVD link : CVE-2018-19791

Mitre link : CVE-2018-19791

CVE.ORG link : CVE-2018-19791

JSON object : View

Products Affected

litespeedtech

openlitespeed

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2018-19791", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-12-03T06:29:00.400", "references": [{"url": "https://github.com/litespeedtech/openlitespeed/issues/117", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/litespeedtech/openlitespeed/issues/117", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the \"bytes=0-,0-\" substring."}, {"lang": "es", "value": "El servidor en LiteSpeed OpenLiteSpeed en versiones anteriores a la 1.5.0 RC6 no manipula correctamente las peticiones para secuencias de bytes, permitiendo a un atacante que ampl\u00ede el tama\u00f1o de la respuesta al solicitar el cuerpo completo de la respuesta de manera repetida, tal y como queda demostrado con con un valor de cabecera HTTP Range que empieza por la subcadena \"bytes=0-,0-\"."}], "lastModified": "2024-11-21T03:58:33.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "516D6E56-E2B0-448E-BEBF-1007DD2F9F96", "versionEndExcluding": "1.5.0"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D166A0A-E47E-4CB9-9802-9E0DF0295523"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F83049D-873B-4597-95AB-A2EB527D3038"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91824E53-FCC7-4DCD-A4EE-FA9A08415842"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB251670-E1F5-43F7-9932-3EC7515CEF33"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB7D62CF-192B-479E-AADB-48B4705EA092"}, {"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69DA7BFE-EB1A-42D1-AC45-A39045BB5A60"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}