CVE-2024-42391
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
Risk Assessment
This could lead to disclosure of sensitive data in memory or application instability, potentially used for further attacks.
Recommendation
Update Cesanta Mongoose to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Cesanta Mongoose Web Server
See all- CVE-2024-42392Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
- CVE-2024-42386High
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
- CVE-2024-42385Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
- CVE-2024-42384High
Integer overflow vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Original NVD description (English source)
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.