Vulnerability Details CVE-2020-13900
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 69.9%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L64
- https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L74
- https://github.com/meetecho/janus-gateway/pull/2214
- https://github.com/merrychap/poc_exploits/tree/master/janus-webrtc/CVE-2020-13900
- https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L64
- https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L74
- https://github.com/meetecho/janus-gateway/pull/2214
- https://github.com/merrychap/poc_exploits/tree/master/janus-webrtc/CVE-2020-13900
Products affected by CVE-2020-13900
-
cpe:2.3:a:meetecho:janus:0.10.0
-
cpe:2.3:a:meetecho:janus:0.9.0
-
cpe:2.3:a:meetecho:janus:0.9.1
-
cpe:2.3:a:meetecho:janus:0.9.2
-
cpe:2.3:a:meetecho:janus:0.9.3
-
cpe:2.3:a:meetecho:janus:0.9.4
-
cpe:2.3:a:meetecho:janus:0.9.5