high7.5
CVE-2018-15504
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2.
Impact
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Embedthis | Appweb | before 7.0.2 |
| Embedthis | Goahead | before 4.0.1 |
| Juniper | Junos | Versions 12.1x46, 12.3x48, 15.1x49, 12.3, 15.1, 15.1x53 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/embedthis/appweb/commit/66067ae6d1fa08b37a270e7dc1821df52ed2daef
- https://github.com/embedthis/appweb/issues/605
- https://github.com/embedthis/goahead/issues/264
- https://supportportal.juniper.net/s/article/2019-07-Security-Bulletin-Junos-OS-J-Web-Denial-of-Service-due-to-multiple-vulnerabilities-in-Embedthis-Appweb-Server
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved
- https://github.com/embedthis/appweb/commit/66067ae6d1fa08b37a270e7dc1821df52ed2daef
- https://github.com/embedthis/appweb/issues/605
- https://github.com/embedthis/goahead/issues/264
- https://supportportal.juniper.net/s/article/2019-07-Security-Bulletin-Junos-OS-J-Web-Denial-of-Service-due-to-multiple-vulnerabilities-in-Embedthis-Appweb-Server
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved