Integer overflow in Alibaba Tengine
CVE-2020-21699
The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests.
Vulnerability class: Integer Overflow
EPSS: 0.007 (48.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Alibaba Tengine — versions 2.2.2
- N/a — versions n/a
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2020-21699?
- CVE-2020-21699 is a high-severity vulnerability in Alibaba Tengine, classified under Integer Overflow or Wraparound. CVSS score: 7.5/10. Published 2023-08-22.
- How severe is CVE-2020-21699?
- High severity. CVSS v3 base score is 7.5 out of 10.