CVE-2023-38320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-38320
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38320.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-38320
Downstream
Published
2023-11-17T06:15:33.667Z
Modified
2026-02-03T04:35:37.953217Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

References

Affected packages

Git / github.com/opennds/opennds

Affected ranges

Type
GIT
Repo
https://github.com/opennds/opennds
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cd4004fc3cf79c0f2bc0ee98db30d225d0b79bc9

Affected versions

v10.*
v10.1.0
v10.1.1
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.2.0
v6.*
v6.0.0
v7.*
v7.0.0
v7.0.1
v8.*
v8.0.0
v8.1.0
v8.1.1
v9.*
v9.0.0
v9.1.0
v9.1.1
v9.10.0
v9.2.0
v9.3.0
v9.4.0
v9.5.0
v9.5.1
v9.6.0
v9.7.0
v9.8.0
v9.9.0
v9.9.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38320.json"

Git / github.com/openwrt/routing

Affected ranges

Type
GIT
Repo
https://github.com/openwrt/routing
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0b19771fb2dd81e7c428759610aed583171eed80

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38320.json"