CVE-2024-42385
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
Risk Assessment
This could lead to memory corruption, application crash, or potential code execution by an attacker.
Recommendation
Update Cesanta Mongoose to a version that includes a fix for this vulnerability.
Other vulnerabilities in Cesanta Mongoose Web Server
See all- CVE-2024-42392Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
- CVE-2024-42391Medium
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- CVE-2024-42386High
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
- CVE-2024-42384High
Integer overflow vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Original NVD description (English source)
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.