Medium severity · published Nov 18, 2024
CVE-2024-42390
Use of Out-of-range Pointer Offset in Mongoose Web Server library
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mongoose Web Server · Cesanta
through 7.14 · source: vendor
MO
Mongoose · Cesanta
through 7.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42390
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42390
Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42390
More from Mongoose Web Server
9.8
CVE-2024-42383
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2018-25193
Mongoose Web Server 6.9 Denial of Service via Socket Connection
7.5
CVE-2024-42392
Improper Neutralization of Delimiters in Mongoose Web Server library
7.5
CVE-2024-42386
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2024-42384
Integer Overflow or Wraparound in Mongoose Web Server library