CVE-2022-35220 TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1

High 7.7 Published 2 Aug 2022 Updated 17 Sep 2024

A remote attacker can cause a denial of service by posting large content, forcing client applications to allocate excessive memory and terminate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-35220?

CVE-2022-35220 is a high-severity denial of service vulnerability in Teamplus Pro, published on 2 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this client’s Teamplus Pro application.

Weakness: CWE-770

Which versions are affected by CVE-2022-35220?

It affects 1 product.

Products include Teamplus Team\+ Pro.

How do I fix CVE-2022-35220?

No fix has been published for CVE-2022-35220 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-35220 being exploited?

There is no known exploitation of CVE-2022-35220 in the wild and no public exploit code.

Sources

Also known as GHSA-cf57-653j-g5mq.