VulnerabilityModified
CVE-2019-18214
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once.
HIGH 7.7EPSS 1.39%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
- CVSS 3.1
- 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- EPSS
- 1.39% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-772
- Affected
- video converter project/video converter
- Source
- cve@mitre.org
References
- https://github.com/PaulLereverend/NextcloudVideo_Converter/issues/22Exploit, Issue Tracking, Third Party Advisory
- https://github.com/PaulLereverend/NextcloudVideo_Converter/issues/22Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.