Vulnerability-Lookup

CVE-2019-5097 (GCVE-0-2019-5097)

Vulnerability from cvelistv5 – Published: 2019-12-03 21:49 – Updated: 2024-08-04 19:47

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

talos

References

URL

	Vendor	Product	Version
	n/a	EmbedThis	Affected: EmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5

CNVD-2019-46984

Vulnerability from cnvd - Published: 2019-12-25

Title

Embedthis Software GoAhead拒绝服务漏洞

Description

Embedthis Software GoAhead是美国Embedthis Software公司的一款嵌入式Web服务器。 Embedthis Software GoAhead存在未明漏洞。攻击者可借助特制的HTTP请求利用该漏洞造成拒绝服务。

Severity

中

Patch Name

Embedthis Software GoAhead拒绝服务漏洞的补丁

Patch Description

Embedthis Software GoAhead是美国Embedthis Software公司的一款嵌入式Web服务器。 Embedthis Software GoAhead存在未明漏洞。攻击者可借助特制的HTTP请求利用该漏洞造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.embedthis.com

Reference

https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0889

Impacted products

Name
['Embedthis Software GoAhead 5.0.1', 'Embedthis Software GoAhead 4.1.1', 'Embedthis Software GoAhead 3.6.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-5097"
    }
  },
  "description": "Embedthis Software GoAhead\u662f\u7f8e\u56fdEmbedthis Software\u516c\u53f8\u7684\u4e00\u6b3e\u5d4c\u5165\u5f0fWeb\u670d\u52a1\u5668\u3002\n\nEmbedthis Software GoAhead\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684HTTP\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.embedthis.com",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-46984",
  "openTime": "2019-12-25",
  "patchDescription": "Embedthis Software GoAhead\u662f\u7f8e\u56fdEmbedthis Software\u516c\u53f8\u7684\u4e00\u6b3e\u5d4c\u5165\u5f0fWeb\u670d\u52a1\u5668\u3002\r\n\r\nEmbedthis Software GoAhead\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684HTTP\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Embedthis Software GoAhead\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Embedthis Software GoAhead 5.0.1",
      "Embedthis Software GoAhead 4.1.1",
      "Embedthis Software GoAhead 3.6.5"
    ]
  },
  "referenceLink": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0889",
  "serverity": "\u4e2d",
  "submitTime": "2019-12-03",
  "title": "Embedthis Software GoAhead\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

ICSA-23-026-06

Vulnerability from csaf_cisa - Published: 2023-01-26 00:00 - Updated: 2023-01-26 00:00

Summary

Rockwell Automation products using GoAhead Web Server

Notes

CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation: Successful exploitation of these vulnerabilities could have a high impact on the confidentiality, integrity, and availability of the vulnerable devices.

Critical infrastructure sectors: Multiple Sectors

Countries/areas deployed: Worldwide

Company headquarters location: United States

Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Exploitability: No known public exploits specifically target these vulnerabilities. These vulnerabilities are exploitable remotely. These vulnerabilities have a low attack complexity.

CVE-2019-5097

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Mitigation 1769-AENTR: Update to 1.003 or later

Mitigation 5069-AEN2TR (discontinued): Migrate to the 5069-AENTR.

Mitigation 1756-EN2T/D: Update to 11.002 or later

Mitigation 1756-EN2TR/C: Update to 11.002 or later

Mitigation 1756-EN2F/C: Update to 11.002 or later

Mitigation 1756-EN2TP/A: Update to 11.002 or later

Mitigation 1756-HIST1G/A (discontinued): Update to series B v5.104 or C 7.100 or later

Mitigation 1756-HIST2G/A (discontinued): Update to series B v5.104 or C 7.100 or later

Mitigation 1756-HIST2G/B: Update to 5.104 or later

Mitigation 1756-EN2F/C: Update to 11.002 or later

Mitigation ControlLogix 5580 controllers: Update to V32.016 or later

Mitigation GuardLogix 5580 controllers: Update to V32.016 or later

Mitigation CompactLogix 5380 controllers: Update to V32.016 or later

Mitigation Compact GuardLogix 5380 controllers: Update to V32.016 or later

Mitigation CompactLogix 5480: Update to V32.016 or later

Mitigation Disable the web server if possible. Review the corresponding product user manual for instructions, which can be found in the Rockwell Automation literature library.

Mitigation For 1732E, upgrade to the latest firmware to disable the web server.

Mitigation Configure firewalls to disallow network communication through HTTP/Port 80.

Mitigation See the Rockwell Automation Knowledgebase article, Security Best Practices, for more recommendations to maintain security posture of an environment

Mitigation Users should see the Rockwell Automation security advisory for more information. https://www.rockwellautomation.com/en-us/support/…

CVE-2019-5096

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Mitigation 1769-AENTR: Update to 1.003 or later

Mitigation 5069-AEN2TR (discontinued): Migrate to the 5069-AENTR.

Mitigation 1756-EN2T/D: Update to 11.002 or later

Mitigation 1756-EN2TR/C: Update to 11.002 or later

Mitigation 1756-EN2F/C: Update to 11.002 or later

Mitigation 1756-EN2TP/A: Update to 11.002 or later

Mitigation 1756-HIST1G/A (discontinued): Update to series B v5.104 or C 7.100 or later

Mitigation 1756-HIST2G/A (discontinued): Update to series B v5.104 or C 7.100 or later

Mitigation 1756-HIST2G/B: Update to 5.104 or later

Mitigation 1756-EN2F/C: Update to 11.002 or later

Mitigation ControlLogix 5580 controllers: Update to V32.016 or later

Mitigation GuardLogix 5580 controllers: Update to V32.016 or later

Mitigation CompactLogix 5380 controllers: Update to V32.016 or later

Mitigation Compact GuardLogix 5380 controllers: Update to V32.016 or later

Mitigation CompactLogix 5480: Update to V32.016 or later

Mitigation Disable the web server if possible. Review the corresponding product user manual for instructions, which can be found in the Rockwell Automation literature library.

Mitigation For 1732E, upgrade to the latest firmware to disable the web server.

Mitigation Configure firewalls to disallow network communication through HTTP/Port 80.

Mitigation See the Rockwell Automation Knowledgebase article, Security Best Practices, for more recommendations to maintain security posture of an environment

Mitigation Users should see the Rockwell Automation security advisory for more information. https://www.rockwellautomation.com/en-us/support/…

References

URL

Category

	https://raw.githubusercontent.com/cisagov/CSAF/de…	self
	https://www.cisa.gov/news-events/ics-advisories/i…	self
	https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-…	external
	https://us-cert.cisa.gov/sites/default/files/reco…	external
	https://www.cve.org/CVERecord?id=CVE-2019-5097	external
	https://www.first.org/cvss/calculator/3.0#CVSS:3.…	external
	https://www.cve.org/CVERecord?id=CVE-2019-5096	external
	https://www.first.org/cvss/calculator/3.0#CVSS:3.…	external

Acknowledgments

Rockwell Automation

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Rockwell Automation",
        "summary": "reporting to CISA that the devices listed may use a version of GoAhead web server with publicly known vulnerabilities"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could have a high impact on the confidentiality, integrity, and availability of the vulnerable devices.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": " Multiple Sectors",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": " Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": " United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are exploitable remotely. These vulnerabilities have a low attack complexity.\u00a0",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-026-06 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-026-06.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-026-06 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-026-06"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      }
    ],
    "title": "Rockwell Automation products using GoAhead Web Server",
    "tracking": {
      "current_release_date": "2023-01-26T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-026-06",
      "initial_release_date": "2023-01-26T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-01-26T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-8CFGM8R/A: firmware version 1.012",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-8CFGM8R/A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-IF4M12R/A (discontinued): firmware version 1.012",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-IF4M12R/A (discontinued)"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-IR4IM12R/A: firmware version 1.012",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-IR4IM12R/A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-IT4IM12R/A: firmware version 1.012",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-IT4IM12R/A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-OF4M12R/A: firmware version 1.012",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-OF4M12R/A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.013",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-OB8M8SR/A: firmware version 1.013",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-OB8M8SR/A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.012",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-IB8M8SOER: firmware version 1.012",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-IB8M8SOER"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.011",
                "product": {
                  "name": "Products using GoAhead Web Server: 1732E-8IOLM12R: firmware version 2.011",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "1732E-8IOLM12R"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.002",
                "product": {
                  "name": "Products using GoAhead Web Server: 1747-AENTR: firmware version 2.002",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "1747-AENTR"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1769-AENTR: firmware version 1.001",
                  "product_id": "CSAFPID-00010"
                }
              }
            ],
            "category": "product_name",
            "name": "1769-AENTR"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.011",
                "product": {
                  "name": "Products using GoAhead Web Server: 5069-AEN2TR: firmware version 3.011",
                  "product_id": "CSAFPID-00011"
                }
              }
            ],
            "category": "product_name",
            "name": "5069-AEN2TR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2TR/C: firmware versions up to and including 11.001",
                  "product_id": "CSAFPID-00012"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2TR/C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2T/D: firmware versions up to and including 11.001",
                  "product_id": "CSAFPID-00013"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2T/D"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.01",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2TSC/B (discontinued): firmware version 10.01",
                  "product_id": "CSAFPID-00014"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2TSC/B (discontinued)"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.01",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2TSC/B: firmware version 10.01",
                  "product_id": "CSAFPID-00015"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2TSC/B"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 3.054",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-HIST1G/A (discontinued): firmware versions up to and including 3.054",
                  "product_id": "CSAFPID-00016"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-HIST1G/A (discontinued)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 3.054",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-HIST2G/A(discontinued): firmware versions up to and including 3.054",
                  "product_id": "CSAFPID-00017"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-HIST2G/A(discontinued)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 5.103",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-HIST2G/B: firmware versions up to and including 5.103",
                  "product_id": "CSAFPID-00018"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-HIST2G/B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "28  - 32",
                "product": {
                  "name": "Products using GoAhead Web Server: ControlLogix 5580 controllers: firmware version V28 - V32",
                  "product_id": "CSAFPID-00019"
                }
              }
            ],
            "category": "product_name",
            "name": "ControlLogix 5580 controllers"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "31  - 32",
                "product": {
                  "name": "Products using GoAhead Web Server: GuardLogix 5580 controllers: firmware version V31 - V32",
                  "product_id": "CSAFPID-00020"
                }
              }
            ],
            "category": "product_name",
            "name": "GuardLogix 5580 controllers"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "28  - 32",
                "product": {
                  "name": "Products using GoAhead Web Server: CompactLogix 5380 controllers: firmware version V28 - V32",
                  "product_id": "CSAFPID-00021"
                }
              }
            ],
            "category": "product_name",
            "name": "CompactLogix 5380 controllers"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "31  - 32",
                "product": {
                  "name": "Products using GoAhead Web Server: Compact GuardLogix 5380 controllers: firmware version V31 - V32",
                  "product_id": "CSAFPID-00022"
                }
              }
            ],
            "category": "product_name",
            "name": "Compact GuardLogix 5380 controllers"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "32",
                "product": {
                  "name": "Products using GoAhead Web Server: CompactLogix 5480 controllers: firmware version V32",
                  "product_id": "CSAFPID-00023"
                }
              }
            ],
            "category": "product_name",
            "name": "CompactLogix 5480 controllers"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756- EN2T/D: firmware version 11.001",
                  "product_id": "CSAFPID-00024"
                }
              }
            ],
            "category": "product_name",
            "name": "1756- EN2T/D"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2TR/C: firmware version 11.001",
                  "product_id": "CSAFPID-00025"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2TR/C"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1765 - EN3TR/B: firmware version 11.001",
                  "product_id": "CSAFPID-00026"
                }
              }
            ],
            "category": "product_name",
            "name": "1765 - EN3TR/B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2F/C: firmware version 11.001",
                  "product_id": "CSAFPID-00027"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2F/C"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.001",
                "product": {
                  "name": "Products using GoAhead Web Server: 1756-EN2TP/A: firmware version 11.001",
                  "product_id": "CSAFPID-00028"
                }
              }
            ],
            "category": "product_name",
            "name": "1756-EN2TP/A"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5097",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial-of-service vulnerability exists in the GoAhead web server. To exploit this vulnerability, a malicious user could send specially crafted HTTP requests and trigger an infinite loop in the process. If exploited, the targeted device could crash.-CVE-2019-5097 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-00010",
          "CSAFPID-00011",
          "CSAFPID-00012",
          "CSAFPID-00013",
          "CSAFPID-00014",
          "CSAFPID-00015",
          "CSAFPID-00016",
          "CSAFPID-00017",
          "CSAFPID-00018",
          "CSAFPID-00019",
          "CSAFPID-00020",
          "CSAFPID-00021",
          "CSAFPID-00022",
          "CSAFPID-00023",
          "CSAFPID-00024",
          "CSAFPID-00025",
          "CSAFPID-00026",
          "CSAFPID-00027",
          "CSAFPID-00028"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5097"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "1769-AENTR: Update to 1.003 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "5069-AEN2TR (discontinued): Migrate to the 5069-AENTR.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2T/D: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2TR/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2F/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2TP/A: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST1G/A (discontinued): Update to series B v5.104 or C 7.100 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST2G/A (discontinued): Update to series B v5.104 or C 7.100 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST2G/B: Update to 5.104 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2F/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5580 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "GuardLogix 5580 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "CompactLogix 5380 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Compact GuardLogix 5380 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "CompactLogix 5480: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable the web server if possible. Review the corresponding product user manual for instructions, which can be found in the Rockwell Automation literature library.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For 1732E, upgrade to the latest firmware to disable the web server.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Configure firewalls to disallow network communication through HTTP/Port 80.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "See the Rockwell Automation Knowledgebase article, Security Best Practices, for more recommendations to maintain security posture of an environment",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Users should see the Rockwell Automation security advisory for more information.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ],
          "url": "https://www.rockwellautomation.com/en-us/support/documentation/literature-library.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2019-5096",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A critical vulnerability exists in how the web server processes requests. If exploited, a malicious user could leverage this vulnerability to execute arbitrary code by sending specially crafted HTTP requests to the targeted device.-CVE-2019-5096 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-00010",
          "CSAFPID-00011",
          "CSAFPID-00012",
          "CSAFPID-00013",
          "CSAFPID-00014",
          "CSAFPID-00015",
          "CSAFPID-00016",
          "CSAFPID-00017",
          "CSAFPID-00018",
          "CSAFPID-00019",
          "CSAFPID-00020",
          "CSAFPID-00021",
          "CSAFPID-00022",
          "CSAFPID-00023",
          "CSAFPID-00024",
          "CSAFPID-00025",
          "CSAFPID-00026",
          "CSAFPID-00027",
          "CSAFPID-00028"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5096"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "1769-AENTR: Update to 1.003 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "5069-AEN2TR (discontinued): Migrate to the 5069-AENTR.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2T/D: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2TR/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2F/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2TP/A: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST1G/A (discontinued): Update to series B v5.104 or C 7.100 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST2G/A (discontinued): Update to series B v5.104 or C 7.100 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-HIST2G/B: Update to 5.104 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756-EN2F/C: Update to 11.002 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5580 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "GuardLogix 5580 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "CompactLogix 5380 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Compact GuardLogix 5380 controllers: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "CompactLogix 5480: Update to V32.016 or later",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable the web server if possible. Review the corresponding product user manual for instructions, which can be found in the Rockwell Automation literature library.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For 1732E, upgrade to the latest firmware to disable the web server.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Configure firewalls to disallow network communication through HTTP/Port 80.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "See the Rockwell Automation Knowledgebase article, Security Best Practices, for more recommendations to maintain security posture of an environment",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        },
        {
          "category": "mitigation",
          "details": "Users should see the Rockwell Automation security advisory for more information.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ],
          "url": "https://www.rockwellautomation.com/en-us/support/documentation/literature-library.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027",
            "CSAFPID-00028"
          ]
        }
      ]
    }
  ]
}

ICSA-24-319-16

Vulnerability from csaf_cisa - Published: 2024-10-29 00:00 - Updated: 2026-05-05 06:00

Summary

Hitachi Energy MSM (Update A)

Severity

High

Notes

Summary: Hitachi Energy has assessed public reports of vulnerabilities initially believed to affect certain versions of the MSM product. Following further technical analysis and validation, Hitachi Energy has determined that the previously referenced product versions are not affected by these vulnerabilities. No customer action is required. Please consult the Recommended Immediate Actions Section for further advice.

Notice: The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support: For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors: MSM is not intrinsically designed to be directly connected to the internet. Disconnect the device from any internet-facing network, if any installation has performed the same. It is recommended to adopt user access management controls and state-of-the-art antivirus software equipped with the latest signature rules on computers that have the MSM Client application installed and running. As an example, please use the operating system's (OS) built-in user access management functionality, if supported, to limit the probability of unauthorized access followed by rogue commands via MSM Client application. It is also recommended to follow the hardening guidelines published by the Center for Internet Security (CIS) https://www.cisecurity.org/about-us/ to protect the host operating system of computers that connect with MSM. This measure would then prevent the lateral movement of the attack vector into MSM via these connected devices. Some examples for Windows-based computers are listed here. 1) CIS Microsoft Windows Desktop Benchmarks (cisecurity.org) 2) CIS Microsoft Windows Server Benchmarks (cisecurity.org)

Critical infrastructure sectors: Energy

Countries/areas deployed: Worldwide

Company headquarters location: Switzerland

SSVC: SSVCv2/E:N/A:N/2026-04-22T14:47:49Z/

Legal Notice and Terms of Use: This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Advisory Conversion Disclaimer: This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000205 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CVE-2024-2398

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE-772 - Missing Release of Resource after Effective Lifetime

Mitigation Hitachi Energy recommends following general mitigation factors. MSM is not intrinsically designed to be directly connected to the internet. Disconnect the device from any internet-facing network, if any installation has performed the same. It is recommended to adopt user access management controls and state-of-the-art antivirus software equipped with the latest signature rules on computers that have the MSM Client application installed and running. As an example, please use the operating system's (OS) built-in user access management functionality, if supported, to limit the probability of unauthorized access followed by rogue commands via MSM Client application. It is also recommended to follow the hardening guidelines published by the Center for Internet Security (CIS) https://www.cisecurity.org/about-us/ to protect the host operating system of computers that connect with MSM. This measure would then prevent the lateral movement of the attack vector into MSM via these connected devices. Some examples for Windows-based computers are listed here. 1) CIS Microsoft Windows Desktop Benchmarks (cisecurity.org) 2) CIS Microsoft Windows Server Benchmarks (cisecurity.org) Cybersecurity Advisory - Industrial Control Systems Cybersecurity Best Practices https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&DocumentPartId=&Action=Launch

CVE-2019-5097

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

References

URL

VAR-201912-0788

Vulnerability from variot - Updated: 2023-12-18 13:01

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server. GoAhead web Server applications contain an infinite loop vulnerability.Service operation interruption (DoS) It may be in a state. Embedthis Software GoAhead is an embedded Web server of American Embedthis Software company

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201912-0788",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "goahead",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "embedthis",
        "version": "4.1.1"
      },
      {
        "model": "goahead",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "embedthis",
        "version": "5.0.1"
      },
      {
        "model": "goahead",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "embedthis",
        "version": "3.6.5"
      },
      {
        "model": "goahead",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "embedthis",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Discovered by a Cisco Talos researcher.",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-5097",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-5097",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-156532",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "talos-cna@cisco.com",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-5097",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-5097",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "talos-cna@cisco.com",
            "id": "CVE-2019-5097",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201912-050",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-156532",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-5097",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server. GoAhead web Server applications contain an infinite loop vulnerability.Service operation interruption (DoS) It may be in a state. Embedthis Software GoAhead is an embedded Web server of American Embedthis Software company",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-5097",
        "trust": 3.4
      },
      {
        "db": "TALOS",
        "id": "TALOS-2019-0889",
        "trust": 2.6
      },
      {
        "db": "JVN",
        "id": "JVNVU93901424",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.0511",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-156532",
        "trust": 0.1
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-23-026-06",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "id": "VAR-201912-0788",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:01:57.368000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "GoAhead",
        "trust": 0.8,
        "url": "https://www.embedthis.com/goahead/"
      },
      {
        "title": "Embedthis Software GoAhead Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=104256"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-835",
        "trust": 1.1
      },
      {
        "problemtype": "infinite loop (CWE-835) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "https://talosintelligence.com/vulnerability_reports/talos-2019-0889"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5097"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu93901424/"
      },
      {
        "trust": 0.6,
        "url": "https://www.talosintelligence.com/vulnerability_reports/talos-2019-0889"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.0511"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/835.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-06"
      },
      {
        "trust": 0.1,
        "url": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/111098"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "date": "2019-12-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "date": "2019-12-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "date": "2019-12-03T22:15:14.900000",
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "date": "2019-12-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-156532"
      },
      {
        "date": "2022-06-17T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-5097"
      },
      {
        "date": "2023-01-30T08:58:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      },
      {
        "date": "2022-06-17T13:34:37.087000",
        "db": "NVD",
        "id": "CVE-2019-5097"
      },
      {
        "date": "2023-01-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GoAhead\u00a0web\u00a0 Infinite loop vulnerability in server applications",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012622"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-050"
      }
    ],
    "trust": 0.6
  }
}

GSD-2019-5097

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-5097

Aliases

CVE-2019-5097

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-5097",
    "description": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.",
    "id": "GSD-2019-5097"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-5097"
      ],
      "details": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.",
      "id": "GSD-2019-5097",
      "modified": "2023-12-13T01:23:55.016238Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "talos-cna@cisco.com",
        "ID": "CVE-2019-5097",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "EmbedThis",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "EmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server."
          }
        ]
      },
      "impact": {
        "cvss": {
          "baseScore": 5.3,
          "baseSeverity": "Medium",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889",
            "refsource": "MISC",
            "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "talos-cna@cisco.com",
          "ID": "CVE-2019-5097"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-835"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-06-17T13:34Z",
      "publishedDate": "2019-12-03T22:15Z"
    }
  }
}

GHSA-CJ8R-MPPQ-QJM5

Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2024-04-04 02:41

Details

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-5097"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-03T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.",
  "id": "GHSA-cj8r-mppq-qjm5",
  "modified": "2024-04-04T02:41:49Z",
  "published": "2022-05-24T17:02:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5097"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2019-5097

Vulnerability from fkie_nvd - Published: 2019-12-03 22:15 - Updated: 2024-11-21 04:44

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	talos-cna@cisco.com	https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889	Exploit, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
embedthis	goahead	3.6.5
embedthis	goahead	4.1.1
embedthis	goahead	5.0.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "81A1B366-C737-43F7-A391-C28C434026C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "957445DB-98D7-4223-8841-A4F364E02B37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5512FFAE-3A29-4E57-AF71-04C9A064711B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de denegaci\u00f3n de servicio en el procesamiento de peticiones datos de formulario multiparte dentro de la aplicaci\u00f3n base del servidor web GoAhead en versiones v5.0.1, v.4.1.1 y v3.6.5. Una petici\u00f3n HTTP especialmente dise\u00f1ada puede conllevar a un bucle infinito en el proceso. La petici\u00f3n puede no ser autenticada en la forma de peticiones GET o POST y no requiere que el recurso solicitado exista en el servidor."
    }
  ],
  "id": "CVE-2019-5097",
  "lastModified": "2024-11-21T04:44:20.923",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "talos-cna@cisco.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-03T22:15:14.900",
  "references": [
    {
      "source": "talos-cna@cisco.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "talos-cna@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2019-5097 (GCVE-0-2019-5097)

CNVD-2019-46984

ICSA-23-026-06

ICSA-24-319-16

VAR-201912-0788

GSD-2019-5097

GHSA-CJ8R-MPPQ-QJM5

FKIE_CVE-2019-5097

Tags

Sightings

Nomenclature