CVE-2020-13432: High severity hfs http file server vulnerability

Published Jun 8, 2020

Updated

rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.

Affected Software

1 affected component

Rejetto HTTP File Server=2.3m

Remediation

Patch Available

https://github.com/rejetto/hfs2/commit/b8ebfc4e22948e1a61506cd66e397b61ea5ea5de

Event History

Jun 8, 2020

CVE Published

via MITRE·05:25 PM

Data Sourced

via MITRE·05:25 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-13432?

CVE-2020-13432 is considered a high severity vulnerability due to the potential for remote denial-of-service attacks.

How do I fix CVE-2020-13432?

To mitigate CVE-2020-13432, consider upgrading to a patched version of Rejetto HFS or implementing network-level protections against malformed HTTP requests.

What versions of Rejetto HFS are affected by CVE-2020-13432?

CVE-2020-13432 affects Rejetto HFS version 2.3m Build #300.

What type of vulnerability is CVE-2020-13432?

CVE-2020-13432 is a remote code execution vulnerability that can lead to an invalid-pointer write access violation.

Can CVE-2020-13432 be exploited remotely?

Yes, CVE-2020-13432 can be exploited remotely through concurrent HTTP requests.