The CVSS 8.7 score for this type-confusion DOS in J-BusinessDirectory likely overstates real-world risk. The EPSS probability of 0.00312 reflects a reasonable market assessment—this is a known PHP vulnerability class with a fragmented installed base and no demonstrated mass-exploitation pattern. The gap between these scores is itself actionable intelligence: prioritize patching based on your exposure to this extension rather than the headline severity alone.
The technical root cause is straightforward: when limitstart[] arrives as an array instead of a scalar integer, PHP's arithmetic operations against it trigger type errors that terminate script execution. This is a logic error that turns malformed input into application failure—not resource exhaustion. Whether this creates persistent DOS depends on your infrastructure. If your stack returns 500s on type errors without rate-limiting or failopen behavior, you have an operational configuration problem layered on top of a code defect. Proper error handling (catching type errors, returning graceful responses) significantly reduces the actual impact.
The more important question the CVE description doesn't answer is whether the unvalidated limit parameter creates a query-manipulation surface beyond DOS. The phrase "limit not validated before use in list queries" is ambiguous—has anyone tested whether non-numeric limit values alter query semantics rather than merely crashing the application? Historical patterns with Joomla components show that type-validation gaps in query parameters have preceded SQL injection surfaces. Investigate whether the limit value interpolates into SQL without parameter binding; if so, the blast radius extends far beyond DOS.
Authentication requirements also need clarification. The CVE doesn't specify whether exploitation requires authenticated access to the directory functionality or works as an unauthenticated remote vector—this materially affects prioritization.
Finally, account for patch diffusion uncertainty. J-BusinessDirectory comes from cmsjunkie.com, a vendor with an unknown update cadence. CMS extensions often update through admin dashboards thatnobody checks, meaning the exposure window between patch availability and actual deployment is measured in months. The 8.7 score assumes a patch exists and will be applied; the EPSS score implicitly accounts for the likelihood that it won't be. Your real priority should scale with how many J-BusinessDirectory instances you maintain and whether you've verified they can receive updates.