PT-2020-14586 · Embedthis · Appweb

Published 2020-07-13 · Updated 2023-01-27 · CVE-2020-15689

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Appweb versions prior to 7.2.2 Appweb versions 8.x prior to 8.1.0

Description The issue arises when Appweb, built with CGI support, fails to properly handle an HTTP request containing a Range header without an exact range. This mishandling can lead to a NULL pointer dereference, resulting in a denial of service.

Recommendations For Appweb versions prior to 7.2.2, update to version 7.2.2 or later. For Appweb versions 8.x prior to 8.1.0, update to version 8.1.0 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-15689

Affected Products

Appweb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15689 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15689 · Vendor Advisory
• ❌ https://github.com/embedthis/appweb-gpl/issues/2 · Note, Deleted