PT-2019-17476 · Goahead · Goahead Web Server

Publicado 2019-11-27 · Atualizado 2022-06-17 · CVE-2019-5096

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead web server versions v3.6.5, v4.1.1, v5.0.1

Description A code execution issue exists in the processing of multi-part/form-data requests within the base GoAhead web server application. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request, corrupting heap structures and potentially leading to full code execution. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

Recommendations For version v3.6.5, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests. For version v4.1.1, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests. For version v5.0.1, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2019-5096

Produtos afetados

Goahead Web Server

Referências · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888 · Exploit
• https://t.me/cybersecuritytechnologies/465 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-5096 · Aviso do Fabricante
• https://t.me/thehackernews/548 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-5096 · Nota de Segurança