Integer overflow in Zcfees Project
CVE-2020-24837
An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.
EPSS: 0.016 (72.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Zcfees_project Zcfees
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-24837?
- CVE-2020-24837 is a high-severity vulnerability in Zcfees Project, classified under Integer Underflow. CVSS score: 7.5/10. Published 2021-02-10.
- How severe is CVE-2020-24837?
- High severity. CVSS v3 base score is 7.5 out of 10.