PT-2024-19199 · Unknown · Lotos Webserver
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Lotos WebServer versions through 0.1.1
Description
The issue is related to a use-after-free in the
buffer avail() function at buffer.h, which occurs when handling a long URI. This is due to the mishandling of realloc.Recommendations
For versions through 0.1.1, consider restricting access to long URIs until a patch is available.
As a temporary workaround, consider disabling the
buffer avail() function until a fix is provided.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lotos Webserver