Stack Memory Exposure in Crow HTTP Applications
CVE-2022-38668

7.5HIGH

Key Information:

Vendor

Crowcpp

Status
Crow
Vendor
CVE Published:
22 August 2022

What is CVE-2022-38668?

The Crow HTTP Framework has a vulnerability that can lead to the unintended exposure of sensitive uninitialized data from stack memory. This occurs when the server processes requests for static files that are smaller than 16 KB, potentially allowing malicious actors to access sensitive information unintentionally included in memory. Developers using Crow need to ensure their applications are configured to handle static file requests securely to mitigate this risk.

References

https://github.com/CrowCpp/Crow/pull/523
x_refsource_MISC
https://gynvael.coldwind.pl/?id=752
x_refsource_MISC
https://github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.