high7.5
CVE-2018-15505
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2.
Impact
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Embedthis | Appweb | before 7.0.2 |
| Embedthis | Goahead | before 4.0.1 |
| Juniper | Junos | Versions 12.3, 12.3x48, 15.1, 15.1x49, 15.1x53, 16.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/embedthis/appweb/commit/16e6979c82297d5fc4f8661e7ada975f51e4dfa9
- https://github.com/embedthis/appweb/issues/605
- https://github.com/embedthis/goahead/issues/264
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_US
- https://github.com/embedthis/appweb/commit/16e6979c82297d5fc4f8661e7ada975f51e4dfa9
- https://github.com/embedthis/appweb/issues/605
- https://github.com/embedthis/goahead/issues/264
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_US