Lucene search

[email protected]CVE-2019-5096

HistoryDec 03, 2019 - 10:15 p.m.

CVE-2019-5096

2019-12-0322:15:14

CWE-416

[email protected]

web.nvd.nist.gov

cve-2019-5096

code execution

vulnerability

goahead web server

http request

use-after-free

heap structures

unauthenticated

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.478 Medium

EPSS

Percentile

97.5%

JSON

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.

Affected configurations

Vulners

NVD

Node

embedthisgoaheadRange≤v3.6.5

VendorProductVersionCPE
embedthisgoahead*cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
embedthis	goahead	*	cpe:2.3:a:embedthis:goahead::::::::

CNA Affected

[
  {
    "product": "EmbedThis",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5"
      }
    ]
  }
]