CVE-2024-3186: Null Pointer Dereference
CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the MEGOAHEADJAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template (JST) files to trigger a crash and cause a Denial of Service (DoS) by providing malicious templates.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3186?
CVE-2024-3186 has a critical severity rating, as it allows remote attackers to cause a denial-of-service condition.
How do I fix CVE-2024-3186?
To fix CVE-2024-3186, upgrade the GoAhead Web Server to a version greater than 6.0.0, ensuring it is not compiled with the ME_GOAHEAD_JAVASCRIPT flag.
What software versions are affected by CVE-2024-3186?
CVE-2024-3186 affects all versions of GoAhead Web Server up to and including version 6.0.0.
What is the impact of CVE-2024-3186?
The impact of CVE-2024-3186 is a denial-of-service condition due to a NULL pointer dereference in the evalExpr() function.
Who can exploit CVE-2024-3186?
CVE-2024-3186 can be exploited by remote attackers who have the ability to modify JavaScript template files on the affected GoAhead Web Server.