Mbedthis AppWeb Format-String Vulnerability

vendor:

AppWeb

by:

Not provided

7.5

CVSS

HIGH

Format-String Vulnerability

Not provided

CWE

Product Name: AppWeb

Affected Version From: AppWeb 2.2.2

Affected Version To: Not provided

Patch Exists: Not provided

Related CWE: Not provided

CPE: Not provided

Metasploit:

Other Scripts:

Platforms Tested: Not provided

Not provided

Mbedthis AppWeb Format-String Vulnerability

Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. This issue affects only applications that were built with logging enabled and installed with no 'ErrorLog' directive in 'appweb.conf'. Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

Mitigation:

Not provided

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/24454/info

Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

This issue affects only applications that were built with logging enabled and installed with no "ErrorLog" directive in 'appweb.conf'.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

AppWeb 2.2.2 is reported vulnerable; other versions may also be affected.

'GET %n://localhost:80/" request'