Critical severity · published Dec 3, 2019
CVE-2019-5096
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1…
9.8
CVSS
67%
EPSS
No
On KEV
Description
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)67.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Goahead · Embedthis
3.6.5; 4.1.1; 5.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5096
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888
More from Goahead
8.1
CVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability
9.8
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the…
9.8
CVE-2021-43298
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting
9.8
CVE-2021-42342
An issue was discovered in GoAhead 4.x and 5.x before 5.1.5
9.8
CVE-2017-1000471
EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service