Use-After-Free Vulnerability in Cesanta Mongoose Embedded Web Server
CVE-2018-20352

8.8HIGH

Key Information:

Vendor

Cesanta

Status
Mongoose Embedded Web Server Library
Vendor
CVE Published:
10 June 2019

What is CVE-2018-20352?

A use-after-free vulnerability has been identified in the mg_cgi_ev_handler function within the source code of the Cesanta Mongoose Embedded Web Server Library version 6.13 and earlier. This vulnerability can lead to denial of service (DoS) by causing application crashes or may be exploited for remote code execution. Proper validation and rigorous testing are essential to mitigate the risks associated with this vulnerability.

References

https://github.com/insi2304/mongoose-6.13-fuzz
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.