PT-2019-17477 · Goahead · Goahead Web Server

Publicado 2019-12-03 · Atualizado 2022-06-17 · CVE-2019-5097

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GoAhead web server versions v3.6.5, v4.1.1, v5.0.1

Description A denial-of-service issue exists in the processing of multi-part/form-data requests in the base GoAhead web server application. This can be triggered by a specially crafted HTTP request, leading to an infinite loop in the process. The request can be unauthenticated, in the form of GET or POST requests, and does not require the requested resource to exist on the server.

Recommendations For version v3.6.5, consider disabling the processing of multi-part/form-data requests until a patch is available. For version v4.1.1, restrict access to the web server application to minimize the risk of exploitation. For version v5.0.1, avoid using the multi-part/form-data request type in the affected API endpoint until the issue is resolved.

Exploit

Correção

DoS

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2019-5097

Produtos afetados

Goahead Web Server

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889 · Exploit
• https://t.me/thehackernews/548 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-5097 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5097 · Aviso do Fabricante