CVE-2024-3187

🗓️ 17 Oct 2024 07:34:50Reported by NozomiType

This tracks two Use After Free and one Double Free vulnerabilities in Goahead <= 6.0.0, caused by JST values not being nulled when freed during parsing. Attackers with ME_GOAHEAD_JAVASCRIPT privileges could exploit this to cause memory corruption leading to DoS or code execution

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-3187	17 Oct 202410:47	–	circl
CNNVD	Embedthis Software GoAhead 资源管理错误漏洞	17 Oct 202400:00	–	cnnvd
CVE	CVE-2024-3187	17 Oct 202407:34	–	cve
EUVD	EUVD-2024-31779	3 Oct 202520:07	–	euvd
NVD	CVE-2024-3187	17 Oct 202408:15	–	nvd
Positive Technologies	PT-2024-24257	17 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-3187	23 May 202510:46	–	redhatcve
The Hacker News	OvrC Platform Vulnerabilities Expose IoT Devices to Remote Attacks and Code Execution	13 Nov 202409:28	–	thn
Vulnrichment	CVE-2024-3187	17 Oct 202407:34	–	vulnrichment

[
  {
    "defaultStatus": "unknown",
    "product": "GoAhead",
    "repo": "https://www.embedthis.com/goahead/download.html",
    "vendor": "EmbedThis",
    "versions": [
      {
        "lessThanOrEqual": "6.0.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
nozominetworks	www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3187

17 Oct 2024 07:34Current

CVSS 3.15.9

EPSS0.04265