CVE-2020-21699

Published Aug 22, 2023

Last updated a year ago

Overview

Description: The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-190

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:alibaba:tengine:2.2.2:*:*:*:*:nginx:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B93765C2-94DC-442F-9D73-D32A947A313F"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References