CVE-2023-27371

MediumCVSS 5.9/10Last modified Oct 14, 2026

Description

GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

Timeline

Published: Feb 28, 2023
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-273729.8SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions ar CVE-2023-273735.5An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a CVE-2023-273757.5Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows ext CVE-2023-273767.5Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows ext CVE-2023-273777.5Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier CVE-2023-273786.1Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an CVE-2023-273798.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting CVE-2023-27389.8A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayControl CVE-2023-273808.8An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially CVE-2023-273827.8Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.15 CVE-2023-273836.8Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a p CVE-2023-273844.3Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data o