← back
CVE-2017-7185

CVE-2017-7185

EPSS 12.3%
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/41826/unverifiedexploitdbwww.exploit-db.com/exploits/41826unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cchttps://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5bhttps://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txthttps://www.exploit-db.com/exploits/41826/http://www.securityfocus.com/archive/1/540355/100/0/threadedhttp://www.securityfocus.com/bid/97370