CVE-2017-2891

Critical

Published: 07/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.

Risk Assessment

An attacker can exploit this vulnerability by sending a crafted HTTP request over the network, which poses a risk of remote code execution on the system.

Recommendation

It is recommended to update to the latest version of Cesanta Mongoose to mitigate this vulnerability and to monitor network traffic for potential attack attempts.

Original NVD description (English source)

An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.