CVE-2018-15504

HIGH 7.5CVE-2018-15504 · Published 18/08/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
appweb embedthis	`< 7.0.2`	`7.0.2`
goahead embedthis	`< 4.0.1`	`4.0.1`

Description

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.

References

embedthis/appweb commit 66067ae · Patch
embedthis/appweb · Exploit
embedthis/goahead · Exploit
supportportal.juniper.net/s/article/2019-07-Security-Bulletin-Junos-OS-J-Web-Denial-of-Service-due-to-multiple-vulnerabilities-in-Embedthis-Appweb-Server · Third Party Advisory
supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free