CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2017-12-12
Embedthis GoAhead Web Server CGI Environment Variable Injection Remote Code Execution (RCE) Vulnerability (CVE-2017-17562) Analysis and Mitigation Guide
[Affected Scope] Embedthis GoAhead versions prior to 3.6.5, when CGI is enabled and CGI programs are dynamically linked
[Impact] Unauthenticated remote attackers can inject environment variables such as LD_PRELOAD via HTTP request parameters, executing malicious shared object (.so) payloads sent in the request body to gain full system control
[Mitigation] Immediately upgrade GoAhead to version 3.6.5 or later, or disable CGI services and deploy WAF rules to block malicious query parameters