CVE-2024-42392CWE-140

CVE-2024-42392

Medium · published November 18, 2024

CVSS v3.1

4.0

EPSS

Percentile

13.8

In the wild

Unconfirmed

What it is

Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.

The record

Technical detail

CVSS v3.1: 4.0 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00236 · 13.8th percentile
Weakness: CWE-140 · Improper Neutralization of Delimiters
Published: 2024-11-18T15:15Z

Affected products (1)

Product	Versions	Fixed in
cesanta/mongoose	≤ 7.14	—

References (2)

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42392 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-142885.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

18 NOV 09:07Z
Improper Neutralization of Delimiters in Mongoose Web Server library
cvelistv5