CVE-2018-8715

EPSS 23.6%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 23.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

14 Mar 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.

Affected products

n/a · n/a

References

https://blogs.securiteam.com/index.php/archives/3676 https://github.com/embedthis/appweb/issues/610 https://security.paloaltonetworks.com/CVE-2018-8715