CVE-2020-28599

2021-02-2415:58:26

CWE-121

talos

www.cve.org

vulnerability

import_stl functionality

code execution

malicious file

openscad

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

59.0%

JSON

A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CNA Affected

[
  {
    "product": "Openscad",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Openscad openscad-2020.12-RC2"
      }
    ]
  }
]