CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21328 – Denial of Service
https://notcve.org/view.php?id=CVE-2021-21328
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters. • https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23 https://github.com/vapor/vapor/releases/tag/4.40.1 https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc https://vapor.codes • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15230 – Arbitrary file read un Vapor
https://notcve.org/view.php?id=CVE-2020-15230
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4. Vapor es un framework web para Swift. • https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255 https://github.com/vapor/vapor/pull/2500 https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •