An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.
Published 2019-12-03 22:15:15
Updated 2022-06-17 13:34:41
Source Talos
View at NVD,   CVE.org
Vulnerability category: Memory Corruption

Exploit prediction scoring system (EPSS) score for CVE-2019-5096

47.82%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-5096

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
NIST
9.8
CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
Talos
9.8
CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
NIST

CWE ids for CVE-2019-5096

  • Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
    Assigned by:
    • nvd@nist.gov (Primary)
    • talos-cna@cisco.com (Secondary)

References for CVE-2019-5096

Products affected by CVE-2019-5096

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!