CVE-2019-5097
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 45.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 45.06% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-835
- Affected
- embedthis/goahead
- Source
- talos-cna@cisco.com
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889Exploit, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.