CVE-2023-4491 Easy Address Book Web Server Buffer overflow vulnerability
An attacker can achieve arbitrary code execution by sending a long username string to the search endpoint of the Easy Address Book Web Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4491?
CVE-2023-4491 is a critical memory corruption vulnerability in EFS Software Easy Address Book Web Server, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine.
Weakness: CWE-119
Which versions are affected by CVE-2023-4491?
It affects 1 product.
Products include Easy Address Book Web Server Project Easy Address Book Web Server.
How do I fix CVE-2023-4491?
No fix has been published for CVE-2023-4491 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-4491 being exploited?
There is no known exploitation of CVE-2023-4491 in the wild and no public exploit code.
Other vulnerabilities in EFS Software Easy Address Book Web Server
Sources
Also known as GHSA-5wvp-xjf2-pj96.