Cyber Resilience

CVE-2024-42389

Medium

Published: 18 November 2024

Published
18 November 2024
Modified
19 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0032 55.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-42389 is a medium-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Cesanta Mongoose. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

CWE(s)
CWE-823NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE-2024-42389 vulnerability in Cesanta Mongoose Web Server enables remote unauthenticated attackers to exploit a public-facing web service via crafted TLS packets, resulting in heap memory disclosure.

Affected Assets

cesanta
mongoose
≤ 7.14

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References