VULNERABILITY INTELLIGENCE

CVE-2009-2732

CVSS score5 MEDIUM
EPSS probability7.27%
CISA KEVNot currently listed
Published2009-08-21
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:N/A:P

Description

The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an Authorization HTTP header that lacks a : (colon) character in the base64-decoded string.

Weakness classification

  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Primary references