CVE-2019-5097 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Embedthis	Goahead	3.6.5

Related Weaknesses (CWE)

CWE-835

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889ExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889ExploitThird Party Advisory

FAQ

What is CVE-2019-5097?

CVE-2019-5097 is a vulnerability with a CVSS score of 7.5 (HIGH). A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP ...

How severe is CVE-2019-5097?

CVE-2019-5097 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-5097?

Check the references section above for vendor advisories and patch information. Affected products include: Embedthis Goahead.