CVE-2019-10648

Опубликовано: 30 мар. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.

Ссылки

https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f
Patch
Third Party Advisory
https://sourceforge.net/p/robocode/bugs/406/
Permissions Required
Third Party Advisory
https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f
Patch
Third Party Advisory
https://sourceforge.net/p/robocode/bugs/406/
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:robocode:robocode:*:*:*:*:*:*:*:*

Версия до 1.9.3.5 (включая)

cpe:2.3:a:robocode:robocode:-:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00726

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2019-10648

CVSS3: 9.8

ubuntu

почти 7 лет назад

CVE-2019-10648

CVSS3: 9.8

debian

почти 7 лет назад

Robocode through 1.9.3.5 allows remote attackers to cause external ser ...

GHSA-q2xp-75m7-gv52

CVSS3: 9.8

github

почти 7 лет назад

Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction

EPSS

Процентиль: 72%

0.00726

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-862