CVE-2014-9707
Embedthis GoAhead Embedded Web Server Directory Traversal
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.
EmbedThis GoAhead 3.0.0 hasta 3.4.1 no maneja correctamente los segmentos de rutas que comienzan con un . (punto), lo que permite a atacantes remotos realizar ataques de salto de directorio, causar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica y caída), o posiblemente ejecutar código arbitrario a través de una URI manipulada.
GoAhead web server versions 3.0.0 through 3.4.1 suffers from heap overflow and directory traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-03-23 CVE Reserved
- 2015-03-28 CVE Published
- 2015-03-28 First Exploit
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-17: DEPRECATED: Code
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/535027/100/0/threaded | Mailing List | |
| http://www.securitytracker.com/id/1032208 | Vdb Entry | |
| https://github.com/embedthis/goahead/commit/eed4a7d177bf94a54c7b06ccce88507fbd76fb77 | X_refsource_confirm | |
| https://github.com/embedthis/goahead/issues/106 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/181142 | 2024-09-01 | |
| https://packetstorm.news/files/id/131156 | 2015-03-28 | |
| http://packetstormsecurity.com/files/131156/GoAhead-3.4.1-Heap-Overflow-Traversal.html | 2024-08-06 | |
| http://seclists.org/fulldisclosure/2015/Mar/157 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.0.0 Search vendor "Embedthis" for product "Goahead" and version "3.0.0" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.1 Search vendor "Embedthis" for product "Goahead" and version "3.3.1" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.2 Search vendor "Embedthis" for product "Goahead" and version "3.3.2" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.3 Search vendor "Embedthis" for product "Goahead" and version "3.3.3" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.4 Search vendor "Embedthis" for product "Goahead" and version "3.3.4" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.5 Search vendor "Embedthis" for product "Goahead" and version "3.3.5" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.3.6 Search vendor "Embedthis" for product "Goahead" and version "3.3.6" | - |
Affected
| ||||||
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | 3.4.0 Search vendor "Embedthis" for product "Goahead" and version "3.4.0" | - |
Affected
| ||||||