CVE-2018-19791: litespeedtech openlitespeed Improper Input Validation

Vulnerability summary

CVE-2018-19791 is a medium (CVSS 6.5) Improper Input Validation vulnerability in litespeedtech openlitespeed. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-12-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.