CVE-2017-2891: Use After Free
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2891?
The severity of CVE-2017-2891 is critical with a CVSS score of 9.8.
What is the affected software for CVE-2017-2891?
The affected software for CVE-2017-2891 is Cesanta Mongoose 6.8.
What is the vulnerability type of CVE-2017-2891?
CVE-2017-2891 is a use-after-free vulnerability.
How can the vulnerability be exploited?
An attacker can exploit CVE-2017-2891 by sending an HTTP POST request with a CGI target, which can cause a reuse of a previously freed pointer potentially leading to remote code execution.
Is there a fix available for CVE-2017-2891?
To fix CVE-2017-2891, it is recommended to update to a version of Cesanta Mongoose without the vulnerability or apply any available patches provided by the vendor.