CVE-2018-12684

Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.

Score

CVSS 3.0 7.1 High

Status

Modified - cve@mitre.org

Published

2018-06-22

Last modified

2024-09-17

Weaknesses

CWE-125, CWE-200

Affected products

• Civetweb (Civetweb Project)

References

• https://github.com/civetweb/civetweb/commit/8fd069f6dedb064339f1091069ac96f3f8bdb552
• https://github.com/civetweb/civetweb/issues/633