CVE-2018-8715

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blogs.securiteam.com/index.php/archives/3676Exploit, Third Party Advisory
https://github.com/embedthis/appweb/issues/610Patch, Third Party Advisory
https://security.paloaltonetworks.com/CVE-2018-8715
https://blogs.securiteam.com/index.php/archives/3676Exploit, Third Party Advisory
https://github.com/embedthis/appweb/issues/610Patch, Third Party Advisory
https://security.paloaltonetworks.com/CVE-2018-8715

Timeline

Published: Mar 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-87165.4WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.CVE-2018-87178.8joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager req CVE-2018-87188.0Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauth CVE-2018-87195.3An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files CVE-2018-87205.4ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka CVE-2018-87216.1Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profi CVE-2018-87226.1Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026.CVE-2018-87247.8K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The comp CVE-2018-87257.8K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The comp CVE-2018-87267.8K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The compon CVE-2018-87277.5Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system to access files or d CVE-2018-87286.1server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /co