CVE-2020-29238: Integer Overflow

Published Mar 10, 2021

Updated

An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.

Affected Software

1 affected component

ExpressVPN ExpressVPN=1.0

Event History

Mar 10, 2021

CVE Published

via MITRE·02:10 AM

Data Sourced

via MITRE·02:10 AM

Description

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-29238?

CVE-2020-29238 is an integer buffer overflow vulnerability in the Nginx webserver of ExpressVPN Router version 1.

How does CVE-2020-29238 affect ExpressVPN Router version 1?

CVE-2020-29238 allows remote attackers to obtain sensitive information when the server is running as a reverse proxy via specially crafted requests.

What is the severity of CVE-2020-29238?

CVE-2020-29238 has a severity rating of high, with a CVSS score of 7.5.

How can I fix CVE-2020-29238?

To fix CVE-2020-29238, it is recommended to update ExpressVPN Router to a version that has addressed the vulnerability.

Are there any references for CVE-2020-29238?

Yes, you can find more information about CVE-2020-29238 at the following references: [expressvpn.com](http://expressvpn.com), [ja1sharma.com](http://ja1sharma.com/blog/2021/CVE-2020-29238/), [packetstormsecurity.com](http://packetstormsecurity.com/files/162152/ExpressVPN-VPN-Router-1.0-Integer-Overflow.html).