CVE-2020-36943
Published: 28 January 2026
Summary
CVE-2020-36943 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Asctimetables (inferred from references). Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-36943 is a denial of service vulnerability in aSc TimeTables version 2021.6.2. The flaw, tied to CWE-770 (allocation of resources without limits or throttling), enables attackers to crash the application by pasting excessive data, such as a 10,000-character buffer, into subject title fields. This input triggers application instability and potential crashes. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, without needing privileges or user interaction. No authentication is required, allowing unauthenticated adversaries to target the application directly. Successful exploitation denies service to legitimate users by causing high-impact crashes, rendering the timetabling software unavailable, while having no effect on confidentiality or integrity.
Advisories and references include a VulnCheck advisory on the aSc TimeTables denial of service issue, as well as a proof-of-concept exploit (ID 49147) published on Exploit-DB. Vendor resources at aSc TimeTables' home and download pages are also referenced, though specific patch details are not outlined in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30891
Vulnerability details
aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with excessive data. Attackers can generate a 10,000-character buffer and paste it into the subject title to trigger application…
more
instability and potential crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly describes remote exploitation of an input-handling flaw (unbounded resource allocation) to crash the application, matching T1499.004 Application or System Exploitation for denial-of-service impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-5 directly protects against denial-of-service attacks like CVE-2020-36943 by implementing safeguards to prevent resource exhaustion from excessive input data.
SI-10 validates information inputs to prevent excessive data like the 10,000-character buffer from triggering application crashes in subject title fields.
SI-9 restricts the amount of information that can be entered into fields, directly mitigating unbounded input leading to resource allocation without limits or throttling.