High severity · published Apr 10, 2017
CVE-2017-7185
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2…
7.5
CVSS
12.3%
EPSS
No
On KEV
Description
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mongoose Embedded Web Server Library · Cesanta
through 6.7 · source: NVD
MO
Mongoose OS · Cesanta
through 1.2 · source: NVD
Affected product
ME
Mongoose Embedded Web Server Library
Cesanta
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7185
www.securityfocus.com
http://www.securityfocus.com/archive/1/540355/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/97370
Patch
https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b
Patch
https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc
Exploit
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt
www.exploit-db.com
https://www.exploit-db.com/exploits/41826/
More from Mongoose Embedded Web Server Library
8.8
CVE-2018-20352
Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service…
8.8
CVE-2017-11567
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify…