Cyber Resilience

CVE-2024-42390

Medium

Published: 18 November 2024

Published
18 November 2024
Modified
19 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0032 55.9th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-42390 is a medium-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Cesanta Mongoose. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

CWE(s)
CWE-823NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2024-42390 is a remote memory disclosure vulnerability in the public-facing Cesanta Mongoose Web Server, allowing attackers to send crafted TLS packets to leak unintended heap memory, enabling exploitation of public-facing applications.

Affected Assets

cesanta
mongoose
≤ 7.14

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References