CVE-2020-37189
Published: 11 February 2026
Summary
CVE-2020-37189 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Co (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
TaskCanvas 1.4.0 contains a denial-of-service vulnerability in the registration code input field, classified under CWE-120 (buffer overflow). The issue allows attackers to crash the application by generating and pasting a 1000-character buffer payload into the field. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with no confidentiality or integrity effects.
Any remote attacker can exploit this vulnerability without authentication or privileges by simply inputting the oversized payload into the registration field during the application's startup or registration process. Successful exploitation results in an application crash, denying service to legitimate users until the application is restarted.
Advisories and references, including those from VulnCheck (https://www.vulncheck.com/advisories/taskcanvas-registration-denial-of-service) and an Exploit-DB entry (https://www.exploit-db.com/exploits/47911), document the vulnerability and proof-of-concept exploit. The vendor's website (https://www.digitalvolcano.co.uk/ and https://www.digitalvolcano.co.uk/taskcanvasdownload.html) provides details on TaskCanvas, where security practitioners should check for updated versions or patches to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31136
Vulnerability details
TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the registration field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in input field directly enables application crash via exploitation, matching T1499.004 (Application or System Exploitation) for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input fields (including the registration code) to reject oversized or malformed data before it reaches vulnerable buffer-handling code.
Requires hardware- or OS-enforced memory protections (e.g., ASLR, DEP, stack canaries) that would block exploitation of the CWE-120 buffer overflow even if an oversized payload is entered.
Mandates timely application of vendor patches or updates that remediate the registration-field buffer overflow in TaskCanvas 1.4.0.