CVE-2023-46586

Critical

Published: 09/10/2024(UTC)Translated: 26/06/2026(UTC)NVD NIST

Summary

In weborf versions 0.17, 0.18, 0.19, and 0.20 (before 1.0), the file cgi.c lacks null termination ('\0') of the path for CGI scripts due to misuse of strncpy.

Risk Assessment

The lack of null termination can lead to out-of-bounds memory read, potentially allowing disclosure of sensitive data or unauthorized code execution.

Recommendation

Immediately upgrade weborf to version 1.0 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.