CVE-2018-8715

EPSS 23.6%

Vexday Risk Score

23Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 23.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

14 mar 2018Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.

Productos afectados

n/a · n/a

Referencias

https://blogs.securiteam.com/index.php/archives/3676 https://github.com/embedthis/appweb/issues/610 https://security.paloaltonetworks.com/CVE-2018-8715