CVE-2018-10945: Null Pointer Dereference

Published Jun 19, 2018

Updated

The mghandlecgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbufinsert function.

Affected Software

1 affected component

Cesanta Mongoose=6.11

Event History

Jun 19, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is CVE-2018-10945?

CVE-2018-10945 is a vulnerability that allows remote attackers to cause a denial of service or application crash in Mongoose 6.11.

How does CVE-2018-10945 affect Mongoose 6.11?

CVE-2018-10945 affects Mongoose 6.11 by allowing remote attackers to cause a denial of service or application crash.

What is the severity of CVE-2018-10945?

The severity of CVE-2018-10945 is high with a score of 7.5.

How can the CVE-2018-10945 vulnerability be exploited?

The CVE-2018-10945 vulnerability can be exploited by sending a malicious HTTP request to the affected Mongoose 6.11 server.

Is there a fix available for CVE-2018-10945?

Yes, upgrading to a version of Mongoose that is not affected by CVE-2018-10945 or applying the necessary patches can fix the vulnerability.