CVE-2023-38314 Null dereference in n/a

Medium 6.5 Published 17 Nov 2023 Updated 2 Aug 2024

A crafted HTTP request causes a null pointer dereference in OpenNDS, leading to a denial-of-service crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-38314?

CVE-2023-38314 is a medium-severity vulnerability in n/a, published on 17 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3.

Weakness: CWE-476

Which versions are affected by CVE-2023-38314?

It affects 1 product.

Products include Opennds Captive Portal.

How do I fix CVE-2023-38314?

Upgrade to a fixed version.

Is CVE-2023-38314 being exploited?

There is no known exploitation of CVE-2023-38314 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2023-38314, GHSA-9752-mq4c-65h9.