Whitepaper Name Goes
Mentions the CVE; no further detail.
CVE-2017-20005 Critical · 9.8 EPSS 3.3%
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a…
Summary
NGINX before 1.13.6 contains a critical buffer overflow in the autoindex module triggered by file modification dates with years exceeding four digits, such as a 1969 date or a false far-future date, which causes an integer overflow. Any system running an affected version of NGINX is impacted.
Official description · CVE.org
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
28.4 / 100
- Exploited
- Not confirmed
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 6 Jun 2021. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 1 threat report1 reportTrustwave
Reports are matched by finding the exact id CVE-2017-20005 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.