CVE-2013-2130 Null dereference in n/a

Medium 4.0 Published 5 Jun 2014 Updated 6 Aug 2024

Authenticated remote attackers can crash the ZNC IRC bouncer via crafted requests to webadmin module pages, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2130?

CVE-2013-2130 is a medium-severity vulnerability in n/a, published on 5 Jun 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.

Which versions are affected by CVE-2013-2130?

It affects 1 product.

Products include Znc Znc.

How do I fix CVE-2013-2130?

Upgrade to a fixed version.

Is CVE-2013-2130 being exploited?

There is no known exploitation of CVE-2013-2130 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-2130, GHSA-fx7f-7phm-xwv9, MGASA-2013-0257.