CVE-2018-8715

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.

CVSS v3.0

8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

22.79% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-287

Published

2018-03-14

Updated

2024-08-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8715.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/appweb/CVE-2018-8715

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2018/CVE-2018-8715.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2018-8639
• CVE-2018-8716
• CVE-2018-8631
• CVE-2018-8718
• CVE-2018-8625
• CVE-2018-8719