VulnerabilityModified

CVE-2014-9708

Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".

MEDIUM 5.0EPSS 56.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 56.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS: 56.19% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-476
Affected: oracle/enterprise communications broker · embedthis/appweb · juniper/junos
Source: cve@mitre.org

EPSS trend

EPSS 56.2% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://packetstormsecurity.com/files/131157/Appweb-Web-Server-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Apr/19Mailing List, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Mar/158Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/03/28/2Mailing List, Patch
http://www.openwall.com/lists/oss-security/2015/04/06/2Mailing List, Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
http://www.securityfocus.com/archive/1/535028/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/archive/1/535028/100/1400/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/73407Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037007Broken Link, Third Party Advisory, VDB Entry
https://github.com/embedthis/appweb/commit/7e6a925f5e86a19a7934a94bbd6959101d0b84eb#diff-7ca4d62c70220e0e226e7beac90c95d9L17348Broken Link, Patch
https://github.com/embedthis/appweb/issues/413Broken Link, Exploit, Issue Tracking
https://security.paloaltonetworks.com/CVE-2014-9708Third Party Advisory
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_USThird Party Advisory
http://packetstormsecurity.com/files/131157/Appweb-Web-Server-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Apr/19Mailing List, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Mar/158Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/03/28/2Mailing List, Patch
http://www.openwall.com/lists/oss-security/2015/04/06/2Mailing List, Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
http://www.securityfocus.com/archive/1/535028/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/archive/1/535028/100/1400/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/73407Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037007Broken Link, Third Party Advisory, VDB Entry
https://github.com/embedthis/appweb/commit/7e6a925f5e86a19a7934a94bbd6959101d0b84eb#diff-7ca4d62c70220e0e226e7beac90c95d9L17348Broken Link, Patch
https://github.com/embedthis/appweb/issues/413Broken Link, Exploit, Issue Tracking
https://security.paloaltonetworks.com/CVE-2014-9708Third Party Advisory
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_USThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.