CVE-2019-14495

webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface

Medium · published August 1, 2019

CVSS v3.0
5.8
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

⚠️ An out-of-bounds write could let an attacker tamper with your admin settings in 3proxy versions before 0.8.13 — think of it as a cheeky chef altering your carefully prepared recipe! Imagine a restaurant kitchen where the head chef has access to the entire pantry but forgets to lock the door. An unauthorized person might slip in and rewrite the menus, serving up surprises no one asked for! If exploited, this vulnerability could allow unauthorized users to modify critical configurations, potentially leading to a mismanaged proxy server. While not immediately devastating, it opens the door for future mischief, making it essential to address. ⚠️

Put simply

Imagine a restaurant kitchen where the head chef has access to the entire pantry but forgets to lock the door. An unauthorized person might slip in and rewrite the menus, serving up surprises no one asked for! This vulnerability in 3proxy's admin interface involves an out-of-bounds write, which can let an attacker manipulate memory outside of intended bounds, affecting the application's behavior.

What to do

If exploited, this vulnerability could allow unauthorized users to modify critical configurations, potentially leading to a mismanaged proxy server. While not immediately devastating, it opens the door for future mischief, making it essential to address. ⚠️ To protect your setup, upgrade to 3proxy version 0.8.13 or later as soon as possible. Regularly audit your admin interface for unauthorized changes, and consider tightening access controls. You've got this! With a quick patch, you'll have your system secured in no time. 🛡️

The record
Technical detail
CVSS v3.0
5.8 · MEDIUM
Vector
CVSS:3.0/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.01878 · 79.3th percentile
Published
2019-08-01T16:48Z
EPSS history
Timeline
  • 01 AUG 16:48Z
    webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface
    cvelistv5