CVE-2024-3187: Use After Free
This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the MEGOAHEADJAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, code execution, though the latter is highly context-dependent.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3187?
CVE-2024-3187 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2024-3187?
To fix CVE-2024-3187, update Goahead to version 6.0.1 or later, which includes the necessary patches.
What types of attacks can be executed using CVE-2024-3187?
CVE-2024-3187 can allow an attacker to execute arbitrary code remotely if the ME_GOAHEAD_JAVASCRIPT flag is enabled.
Which versions of Goahead are affected by CVE-2024-3187?
CVE-2024-3187 affects all versions of Goahead up to and including 6.0.0.
What are the common vulnerabilities associated with CVE-2024-3187?
CVE-2024-3187 includes two Use After Free (UAF) vulnerabilities and one Double Free vulnerability.