CVE-2020-11722

CRITICAL

9.8

Description

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/12/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

dungeon_crawl_stone_soup_project:dungeon_crawl_stone_soup

Weaknesses (CWE)

CWE-434

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html(cve@mitre.org)

https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html(cve@mitre.org)

https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04(cve@mitre.org)

https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/(cve@mitre.org)

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html(af854a3a-2127-422b-91ae-364da2661108)

https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.