Denial of Service Vulnerability in Embedthis GoAhead and Appweb Products
CVE-2018-15505

7.5HIGH

Key Information:

Vendor

Embedthis

Status
Appweb
Goahead
Vendor
CVE Published:
18 August 2018

What is CVE-2018-15505?

A vulnerability in Embedthis GoAhead and Appweb allows an attacker to exploit a NULL pointer dereference through a specially crafted HTTP POST request with an incorrect 'Host' header. This flaw can lead to a denial of service condition, which may severely impact the availability of applications using these products. Specifically, a malformed trailing character in an IPv6 address can trigger this vulnerability, leading to unexpected application behavior and service disruptions.

References

https://github.com/embedthis/appweb/issues/605
https://github.com/embedthis/goahead/issues/264
https://github.com/embedthis/appweb/commit/16e6979c82297d...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.