Appweb 3.1.x / 3.2.x / 3.3.x < 3.3.3 mprUrlEncode Function Heap Overflow Vulnerability

Medium Nessus Plugin ID 61396


The remote web server may be affected by a buffer overflow vulnerability.


According to its banner, the version of Appweb installed on the remote host is 3.1.x, 3.2.x or 3.3.x earlier than 3.3.3. It is, therefore, potentially affected by a heap-based buffer overflow vulnerability caused by a casting error in the function 'mprUrlEncode' in the file 'src/mpr/mprLib.c'.

Note that Nessus did not actually test for this issue, but instead has relied on the version in the server's banner.

Further note that this issue reportedly only affects Appweb when running on Microsoft Windows operating systems.


Upgrade to Appweb version 3.3.3 or later.

See Also

Plugin Details

Severity: Medium

ID: 61396

File Name: appweb_server_3_3_3.nasl

Version: $Revision: 1.7 $

Type: remote

Family: Web Servers

Published: 2012/08/02

Modified: 2018/01/12

Dependencies: 11936, 61395

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mbedthis_software:mbedthis_appweb_http_server

Required KB Items: www/appweb

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2012/06/07

Vulnerability Publication Date: 2012/06/07

Reference Information

OSVDB: 89593