Details of VAR-201911-1358

ID

VAR-201911-1358

CVE

CVE-2019-19240

TITLE

Embedthis GoAhead Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-012569

DESCRIPTION

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response. Embedthis GoAhead Contains a buffer error vulnerability.Information may be obtained. Embedthis Software GoAhead is an embedded Web server of American Embedthis Software company. A buffer error vulnerability exists in Embedthis Software GoAhead versions prior to 5.0.1. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc

Trust: 1.71

sources: NVD: CVE-2019-19240 // JVNDB: JVNDB-2019-012569 // VULHUB: VHN-151667

AFFECTED PRODUCTS

vendor:

embedthis

model:

goahead

scope:

version:

5.0.1

Trust: 1.8

sources: JVNDB: JVNDB-2019-012569 // NVD: CVE-2019-19240

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19240
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-19240
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-1314
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-151667
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-19240
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-151667
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-19240
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2019-19240
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-151667 // JVNDB: JVNDB-2019-012569 // CNNVD: CNNVD-201911-1314 // NVD: CVE-2019-19240

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.1
problemtype:	CWE-908	Trust: 1.1
problemtype:	CWE-119	Trust: 0.8

sources: VULHUB: VHN-151667 // JVNDB: JVNDB-2019-012569 // NVD: CVE-2019-19240

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1314

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201911-1314

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012569

PATCH

title:	v5.0.1	url:	https://github.com/embedthis/goahead/releases/tag/v5.0.1	Trust: 0.8
title:	WebsRedirect disclosure with large host names #289	url:	https://github.com/embedthis/goahead/issues/289	Trust: 0.8
title:	WebsRedirect information disclosure #290	url:	https://github.com/embedthis/goahead/issues/290	Trust: 0.8
title:	Embedthis Software GoAhead Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103450	Trust: 0.6

sources: JVNDB: JVNDB-2019-012569 // CNNVD: CNNVD-201911-1314

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19240	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-012569	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-1314	Trust: 0.7
db:	VULHUB	id:	VHN-151667	Trust: 0.1

sources: VULHUB: VHN-151667 // JVNDB: JVNDB-2019-012569 // CNNVD: CNNVD-201911-1314 // NVD: CVE-2019-19240

REFERENCES

url:	https://github.com/embedthis/goahead/issues/289	Trust: 1.7
url:	https://github.com/embedthis/goahead/issues/290	Trust: 1.7
url:	https://github.com/embedthis/goahead/releases/tag/v5.0.1	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19240	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19240	Trust: 0.8

sources: VULHUB: VHN-151667 // JVNDB: JVNDB-2019-012569 // CNNVD: CNNVD-201911-1314 // NVD: CVE-2019-19240

SOURCES

db:	VULHUB	id:	VHN-151667
db:	JVNDB	id:	JVNDB-2019-012569
db:	CNNVD	id:	CNNVD-201911-1314
db:	NVD	id:	CVE-2019-19240

LAST UPDATE DATE

2024-08-14T14:12:08.730000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-151667	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-012569	date:	2019-12-05T00:00:00
db:	CNNVD	id:	CNNVD-201911-1314	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-19240	date:	2020-08-24T17:37:01.140

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-151667	date:	2019-11-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-012569	date:	2019-12-05T00:00:00
db:	CNNVD	id:	CNNVD-201911-1314	date:	2019-11-22T00:00:00
db:	NVD	id:	CVE-2019-19240	date:	2019-11-22T19:15:12.857