Paper/Archive/CVE-2020-11722

CVE-2020-11722

mitre — Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in a…

EPSS 4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 90.2.902 × 2018.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html refgithub.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04 refgithub.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28 advisorylists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP