PT-2024-24257 · Goahead · Goahead

Diego Zaffaroni · Published 2024-10-17 · Updated 2026-03-18 · CVE-2024-3187

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Goahead versions <= 6.0.0

Description This issue involves two Use After Free (UAF) and one Double Free vulnerabilities. These vulnerabilities are caused by JST values not being nulled when freed during parsing of JST templates. If the ME GOAHEAD JAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, code execution.

Recommendations For Goahead versions <= 6.0.0, consider disabling the ME GOAHEAD JAVASCRIPT flag to prevent exploitation until a patch is available. Restrict access to JST files to minimize the risk of malicious template modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Double Free

Weakness Enumeration

CWE-416

CWE-415

Related Identifiers

CVE-2024-3187

Affected Products

Goahead

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-3187 · Security Note
• https://t.me/cvedetector/8152 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2024-3187 · Note
• https://twitter.com/VulmonFeeds/status/1846867389507321875 · Twitter Post
• https://twitter.com/dailycve/status/2034295270058459531 · Twitter Post
• https://twitter.com/CVEnew/status/1846821380345491931 · Twitter Post