Appweb 3.1.x / 3.2.x / 3.3.x < 3.3.3 mprUrlEncode Function Heap Overflow Vulnerability

medium Nessus Plugin ID 61396


The remote web server may be affected by a buffer overflow vulnerability.


According to its banner, the version of Appweb installed on the remote host is 3.1.x, 3.2.x or 3.3.x earlier than 3.3.3. It is, therefore, potentially affected by a heap-based buffer overflow vulnerability caused by a casting error in the function 'mprUrlEncode' in the file 'src/mpr/mprLib.c'.

Note that Nessus did not actually test for this issue, but instead has relied on the version in the server's banner.

Further note that this issue reportedly only affects Appweb when running on Microsoft Windows operating systems.


Upgrade to Appweb version 3.3.3 or later.

See Also

Plugin Details

Severity: Medium

ID: 61396

File Name: appweb_server_3_3_3.nasl

Version: 1.10

Type: remote

Family: Web Servers

Published: 8/2/2012

Updated: 11/15/2018

Risk Information


Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mbedthis_software:mbedthis_appweb_http_server

Required KB Items: www/appweb

Patch Publication Date: 6/7/2012

Vulnerability Publication Date: 6/7/2012