Published: 15/03/2018 Updated: 17/02/2020
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

The Embedthis HTTP library, and Appweb versions prior to 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.

Vulnerability Trend

Vendor Advisories

Palo Alto Networks makes use of a 3rd-party component impacted by CVE-2018-8715 This issue has been confirmed to present a risk for denial of service to the PAN-OS Management Web Interface (Ref # PAN-93089, CVE-2018-8715) ...

Github Repositories

AppWeb认证绕过漏洞(CVE-2018-8715) AppWeb是Embedthis Software LLC公司负责开发维护的一个基于GPL开源协议的嵌入式Web Server。他使用C/C++来编写,能够运行在几乎先进所有流行的操作系统上。当然他最主要的应用场景还是为嵌入式设备提供Web Application容器。 AppWeb可以进行认证配置,其认证方式包