CVE-2023-2905

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290509.6The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside CVE-2023-290518.1User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the CVE-2023-290525.4Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attack CVE-2023-290537.8A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected application CVE-2023-290547.4A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE CVE-2023-290557.5In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that ma CVE-2023-290565.9A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must CVE-2023-290578.8A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to CVE-2023-290586.5A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message CVE-2023-290597.83CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18 CVE-2023-29066.5Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptib CVE-2023-290605.7The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor wit