CVE-2019-16645: embedthis goahead Code Injection

Vulnerability summary

CVE-2019-16645 is a high (CVSS 8.6) Code Injection vulnerability in embedthis goahead. EPSS estimates a 8.18% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-09-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.