CVE-2019-5097
published 2019-12-03CVE-2019-5097: A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1…
PriorityP357high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
45.06%
98.6th percentile
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| embedthis | goahead | — | — |
| embedthis | goahead | — | — |
| embedthis | goahead | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy MSM
cisa_ics·2024-11-14·CVSS 8.6
[HIGH] Hitachi Energy MSM
ICS Advisory
##
Hitachi Energy MSM
Release DateNovember 14, 2024
Alert CodeICSA-24-319-16
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.6
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: MSM
- Vulnerabilities: Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop')
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to impact the confidentiality, integrity or availability of the MSM.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Hitachi Energy MSM, a condition monitoring system, are affected:
- MSM
CISA ICS
Rockwell Automation products using GoAhead Web Server
cisa_ics·2023-01-26·CVSS 9.8
[CRITICAL] Rockwell Automation products using GoAhead Web Server
ICS Advisory
##
Rockwell Automation products using GoAhead Web Server
Last RevisedJanuary 26, 2023
Alert CodeICSA-23-026-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Rockwell Automation
- Equipment: Products using GoAhead Web Server
- Vulnerabilities: Infinite Loop, Use after Free
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could have a high impact on the confidentiality, integrity, and availability of the vulnerable devices.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Rockwell Automation reports the following products use a version of GoAhead web server vulnerable to both CVE-2019-5096 and CVE-2019-5097:
- 1732E-8CFGM8R/A: firmware version 1.012
- 1732E-IF4M1
GHSA
GHSA-cj8r-mppq-qjm5: A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5
ghsa_unreviewed·2022-05-24
CVE-2019-5097 [HIGH] CWE-835 GHSA-cj8r-mppq-qjm5: A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.
No detection rules found.
No public exploits indexed.
2019-12-03
Published