PatchTheCVEembedthis vulnerabilities
Recent CVEs affecting embedthis products. 6 tracked.
embedthis has 6 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-08-08. Highest priority: CVE-2021-42342 (score 64/100).
- CVE-2021-43298 CRITICAL 9.8 UPGRADE The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time m
- CVE-2021-42342 CRITICAL 9.8 UPGRADE An issue was discovered in GoAhead 4.x and 5.x before 5.1.5
- CVE-2021-41615 CRITICAL 9.8 DOWNGRADE websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the
- CVE-2021-33254 HIGH 7.5 DOWNGRADE An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to
- CVE-2020-15689 HIGH 7.5 UPGRADE Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range
- CVE-2020-15688 HIGH 8.8 UPGRADE The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against repl
FAQ
How do I fix embedthis vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is embedthis being exploited right now?
None of the tracked embedthis CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which embedthis CVE should I patch first?
CVE-2021-42342 currently ranks highest (64/100): An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.