CVE-2017-11567

HIGH 8.8CVE-2017-11567 · Published 07/09/2017 · updated 17/06/2026

In short

CVE-2017-11567 is a HIGH (CVSS 8.8) vulnerability affecting mongoose embedded web server library (cesanta).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mongoose embedded web server library cesanta	`≤ 6.8`	No fix yet

Description

Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.

References

hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt · Exploit
seclists.org/fulldisclosure/2017/Sep/3 · Exploit
exploit-db.com/exploits/42614 · Exploit

More vulnerabilities in mongoose embedded web server library

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free