CVE-2018-8065

EPSS 76.5%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (6 stars) — exploitation code widely available.

CVSS —EPSS 76.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

09 Mar 2018Metasploit module available

12 Mar 2018Published on NVD

25 May 2018Public PoC

Weaponization speed

75 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/EgeBalci/CVE-2018-8065★ 6 cve_referencepacketstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.htmlunverified exploitdbwww.exploit-db.com/exploits/51493unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS https://github.com/rapid7/metasploit-framework/pull/9701