Test ID:	1.3.6.1.4.1.25623.1.0.117539
Category:	Web Servers
Title:	Mongoose Web Server <= 6.13 Multiple Vulnerabilities
Summary:	Mongoose Web Server is prone to multiple vulnerabilities.
Description:	Summary: Mongoose Web Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2018-18764, CVE-2018-18765: arbitrary memory read vulnerabilities in the MQTT packet-parsing functionality - CVE-2018-19587: SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function Affected Software/OS: Mongoose Web Server version 6.13 and prior. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-18764 https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow1.md https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow2.md Common Vulnerability Exposure (CVE) ID: CVE-2018-18765 https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md https://twitter.com/thracky/status/1059472674940993541 Common Vulnerability Exposure (CVE) ID: CVE-2018-19587 https://github.com/insi2304/mongoose-fuzz
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.