High severity8.8OSV Advisory· Published Sep 7, 2017· Updated Jun 17, 2026
CVE-2017-11567
CVE-2017-11567
Description
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
33.2, 3.3, 3.4, …+ 1 more
- (no CPE)range: 3.2, 3.3, 3.4, …
- cpe:2.3:a:cesanta:mongoose_embedded_web_server_library:*:*:*:*:*:*:*:*range: <=6.8
- Range: <6.9
Patches
Vulnerability mechanics
References
3- hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txtnvdExploit
- seclists.org/fulldisclosure/2017/Sep/3nvdExploitMailing ListThird Party Advisory
- www.exploit-db.com/exploits/42614/nvdExploitThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.