Products
Technitium
- through 11.0.2
Source
cve@mitre.org
Tags
CVE-2023-28456 details
Published : Sept. 18, 2024, 3:15 p.m.
Last Modified : Sept. 18, 2024, 6:35 p.m.
Last Modified : Sept. 18, 2024, 6:35 p.m.
Description
An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.5 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
7.5
Exploitability Score
3.9
Impact Score
3.6
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
| URL | Source |
|---|---|
| https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3 | cve@mitre.org |
| https://technitium.com/dns/ | cve@mitre.org |
This website uses the NVD API, but is not approved or certified by it.