What is the CVSS score of CVE-2013-1762?

CVE-2013-1762 has a CVSS 2.0 base score of 6.6 (Medium). CVSS vector: AV:N/AC:H/Au:N/C:P/I:P/A:C. EPSS exploitation probability: 2.0%.

Stunnel CVE-2013-1762

MEDIUM

Code Injection (CWE-94)

2013-03-08 cve@mitre.org

Buffer Overflow Code Injection RCE Stunnel

6.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/Au:N/C:P/I:P/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:H/Au:N/C:P/I:P/A:C

Attack Vector

Network

Attack Complexity

High

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Mar 08, 2013 - 18:55 cve.org

MEDIUM 6.6

DescriptionCVE.org

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

AnalysisAI

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow. Affected products include: Stunnel. Version information: through 4.54.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.