CVE-2024-55653CWE-20

pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)

Medium · published December 10, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the rejection. With the backend being unresponsive, the whole application becomes unusable for all users of the application. As of time of publication, no known patches are available.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-12-10T22:56Z
EPSS history
Timeline
  • 10 DEC 22:56Z
    pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)
    cvelistv5