CVE-2019-5096

highPriorität · beachten · 72EPSS 0.670 · 99. PerzentilExploit · PoCEUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · PoC
Likely / severe?
67.0% (99th) EPSS
CVSS 7.5 · high
Is it mine?
60 products
Prüfe deine Angriffsfläche
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-26

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

  • Mitigation1732E-8CFGM8R/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-8IOLM12Rcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-IB8M8SOERcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-IF4M12R/A (discontinued)cisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-IR4IM12R/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-IT4IM12R/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-OB8M8SR/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1732E-OF4M12R/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1747-AENTRcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756- EN2T/Dcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2F/Ccisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2T/Dcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2TP/Acisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2TR/Ccisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2TSC/Bcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-EN2TSC/B (discontinued)cisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-HIST1G/A (discontinued)cisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-HIST2G/A(discontinued)cisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1756-HIST2G/Bcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1765 - EN3TR/Bcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation1769-AENTRcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • Mitigation5069-AEN2TRcisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • MitigationCompact GuardLogix 5380 controllerscisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • MitigationCompactLogix 5380 controllerscisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • MitigationCompactLogix 5480 controllerscisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • MitigationControlLogix 5580 controllerscisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

  • MitigationGuardLogix 5580 controllerscisa_csaf_ot

    1756-EN2F/C: Update to 11.002 or later

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · talos-cna@cisco.com USAusnutzbarkeit 3.9 · Auswirkung 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-416USprimärCWE-416US
04

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

05

betroffene Produkte (60)

Betroffene Produkte und Versionsbereiche.

20 von 60 angezeigt
06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-23-026-06Rockwell Automation products using GoAhead Web Server2023-01-26icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could have a high impact on the confidentiality, integrity, and availability of the vulnerable devices.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2019-12-03geändert 2026-06-17
10

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan