CVE-2020-11722

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

3.92%

Published

Apr 12, 2020

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

Affected Products (1)

dungeon_crawl_stone_soup_project · dungeon_crawl_stone_soup (up to 0.25)vulnerable

References (12)

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html

https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html

PatchThird Party Advisory

https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04

PatchThird Party Advisory

https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html

https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html

PatchThird Party Advisory

https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04

PatchThird Party Advisory

https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/

KEV Catalog EPSS Scores Vendors All CVEs