High severity · published Aug 18, 2018
CVE-2018-15505
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Junos OS · Juniper
12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more · source: NVD
AP
Appweb · Embedthis
before 7.0.2 · source: NVD
GO
Goahead · Embedthis
before 4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15505
Patch
https://github.com/embedthis/appweb/commit/16e6979c82297d5fc4f8661e7ada975f51e4dfa9
Broken Link
https://github.com/embedthis/appweb/issues/605
Broken Link
https://github.com/embedthis/goahead/issues/264
Not Applicable
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_US
More from Junos OS
9.8
CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
9.8
CVE-2020-1631
Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
7.5
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
5.3
CVE-2023-36851
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
5.3
CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files