Vulnerability Description
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the context of the vulnerable service.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Crowcpp | Crow | < 1.0\+4 |
Related Weaknesses (CWE)
References
- https://cwe.mitre.org/data/definitions/193.htmlThird Party Advisory
- https://github.com/0xhebi/CVE-2022-34970/blob/master/report.mdExploitThird Party Advisory
- https://github.com/CrowCpp/Crow/pull/486PatchThird Party Advisory
- https://github.com/CrowCpp/Crow/releases/tag/v1.0%2B4Third Party Advisory
- https://cwe.mitre.org/data/definitions/193.htmlThird Party Advisory
- https://github.com/0xhebi/CVE-2022-34970/blob/master/report.mdExploitThird Party Advisory
- https://github.com/CrowCpp/Crow/pull/486PatchThird Party Advisory
- https://github.com/CrowCpp/Crow/releases/tag/v1.0%2B4Third Party Advisory
FAQ
What is CVE-2022-34970?
CVE-2022-34970 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the...
How severe is CVE-2022-34970?
CVE-2022-34970 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-34970?
Check the references section above for vendor advisories and patch information. Affected products include: Crowcpp Crow.