WaratekVRT Sign in

CVE-2014-9708 Embedthis Appweb

Affected softwareEmbedthis Appweb
Severity5.0 Medium CVSS 2.0
WeaknessCWE-476
Published31 Mar 2015
Updated17 Jun 2026

Description

Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".

Exploitation status

Forecast only (56% 30-day chance)

No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.94% of all scored CVEs. That is a model's forecast, not a report of exploitation.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 56% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (oracle/enterprise_communications_broker). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2016 ↗ CPU 2016-Q3 Oracle Communications Applications / GUI (Prior to PCz 2.0.0m4p1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications GUI Prior to PCz 2.0.0m4p1

Products and versions

3 products, 300 version entries
SourceVendorProductSchemeAffected versions
nvd embedthis appweb generic ＜ 4.6.6 · ≥ 5.0.0 and ＜ 5.2.1
nvd juniper junos generic 12.1x46 · 12.1x46:d10 · 12.1x46:d15 · 12.1x46:d20 · 12.1x46:d25 · 12.1x46:d30 · 12.1x46:d35 · 12.1x46:d40 · 12.1x46:d45 · 12.1x46:d50 · 12.1x46:d55 · 12.1x46:d60 · 12.1x46:d65 · 12.1x46:d66 · 12.1x46:d67 · 12.1x46:d70 · 12.1x46:d71 · 12.1x46:d72 · 12.1x46:d73 · 12.1x46:d76 · 12.1x46:d77 · 12.3 · 12.3:r1 · 12.3:r2 · 12.3:r3 · 12.3:r4 · 12.3:r5 · 12.3:r6 · 12.3:r7 · 12.3:r8 · 12.3:r9 · 12.3:r10 · 12.3:r10-s1 · 12.3:r10-s2 · 12.3:r11 · 12.3:r12 · 12.3:r12-s1 · 12.3:r12-s3 · 12.3:r12-s4 · 12.3:r12-s6 · 12.3:r12-s8 · 12.3:r12-s10 · 12.3:r12-s11 · 12.3:r12-s12 · 12.3:r13 · 12.3x48 · 12.3x48:d10 · 12.3x48:d15 · 12.3x48:d20 · 12.3x48:d25 · 12.3x48:d30 · 12.3x48:d35 · 12.3x48:d40 · 12.3x48:d45 · 12.3x48:d50 · 12.3x48:d51 · 12.3x48:d55 · 12.3x48:d60 · 12.3x48:d65 · 12.3x48:d66 · 12.3x48:d70 · 12.3x48:d75 · 15.1 · 15.1:f · 15.1:r · 15.1:a1 · 15.1:f1 · 15.1:r1 · 15.1:f2 · 15.1:r2 · 15.1:f2-s1 · 15.1:f2-s2 · 15.1:f2-s3 · 15.1:f2-s4 · 15.1:f3 · 15.1:r3 · 15.1:f4 · 15.1:r4 · 15.1:r4-s7 · 15.1:r4-s8 · 15.1:r4-s9 · 15.1:f5 · 15.1:r5 · 15.1:r5-s1 · 15.1:r5-s3 · 15.1:r5-s5 · 15.1:r5-s6 · 15.1:f5-s7 · 15.1:f6 · 15.1:r6 · 15.1:f6-s1 · 15.1:r6-s1 · 15.1:f6-s2 · 15.1:r6-s2 · 15.1:f6-s3 · 15.1:r6-s3 · 15.1:f6-s4 · 15.1:r6-s4 · 15.1:f6-s5 · 15.1:f6-s6 · 15.1:r6-s6 · 15.1:f6-s7 · 15.1:f6-s8 · 15.1:f6-s9 · 15.1:f6-s10 · 15.1:f6-s12 · 15.1:f7 · 15.1:r7 · 15.1:r7-s1 · 15.1:r7-s2 · 15.1:r7-s3 · 15.1:r7-s10 · 15.1:r7-s11 · 15.1:r7-s12 · 15.1x49 · 15.1x49:d10 · 15.1x49:d15 · 15.1x49:d20 · 15.1x49:d25 · 15.1x49:d30 · 15.1x49:d35 · 15.1x49:d40 · 15.1x49:d45 · 15.1x49:d50 · 15.1x49:d55 · 15.1x49:d60 · 15.1x49:d65 · 15.1x49:d70 · 15.1x49:d75 · 15.1x49:d80 · 15.1x49:d90 · 15.1x49:d100 · 15.1x49:d110 · 15.1x49:d120 · 15.1x49:d130 · 15.1x49:d131 · 15.1x49:d140 · 15.1x49:d150 · 15.1x49:d160 · 15.1x49:d170 · 15.1x53 · 15.1x53:d10 · 15.1x53:d20 · 15.1x53:d21 · 15.1x53:d25 · 15.1x53:d30 · 15.1x53:d31 · 15.1x53:d32 · 15.1x53:d33 · 15.1x53:d34 · 15.1x53:d40 · 15.1x53:d45 · 15.1x53:d47 · 15.1x53:d48 · 15.1x53:d50 · 15.1x53:d51 · 15.1x53:d52 · 15.1x53:d55 · 15.1x53:d56 · 15.1x53:d57 · 15.1x53:d58 · 15.1x53:d59 · 15.1x53:d60 · 15.1x53:d61 · 15.1x53:d62 · 15.1x53:d63 · 15.1x53:d64 · 15.1x53:d65 · 15.1x53:d66 · 15.1x53:d67 · 15.1x53:d68 · 15.1x53:d70 · 15.1x53:d210 · 15.1x53:d230 · 15.1x53:d231 · 15.1x53:d232 · 15.1x53:d233 · 15.1x53:d234 · 15.1x53:d235 · 15.1x53:d236 · 15.1x53:d237 · 15.1x53:d470 · 15.1x53:d471 · 15.1x53:d490 · 15.1x53:d495 · 15.1x53:d590 · 16.1 · 16.1:r1 · 16.1:r2 · 16.1:r3 · 16.1:r3-s8 · 16.1:r3-s10 · 16.1:r3-s11 · 16.1:r4 · 16.1:r4-s2 · 16.1:r4-s3 · 16.1:r4-s4 · 16.1:r4-s6 · 16.1:r4-s8 · 16.1:r4-s9 · 16.1:r4-s12 · 16.1:r5 · 16.1:r5-s4 · 16.1:r6 · 16.1:r6-s1 · 16.1:r6-s3 · 16.1:r6-s4 · 16.1:r6-s6 · 16.1:r7 · 16.1:r7-s2 · 16.1:r7-s3 · 16.1:r7-s4 · 16.1:r7-s5 · 16.2 · 16.2:r1 · 16.2:r1-s6 · 16.2:r2 · 16.2:r2-s1 · 16.2:r2-s2 · 16.2:r2-s5 · 16.2:r2-s6 · 16.2:r2-s7 · 16.2:r2-s8 · 16.2:r2-s10 · 17.1 · 17.1:r1 · 17.1:r1-s7 · 17.1:r2 · 17.1:r2-s1 · 17.1:r2-s2 · 17.1:r2-s3 · 17.1:r2-s4 · 17.1:r2-s5 · 17.1:r2-s6 · 17.1:r2-s7 · 17.1:r2-s8 · 17.1:r2-s9 · 17.1:r2-s10 · 17.1:r2-s11 · 17.2:r2 · 17.2:r2-s4 · 17.2:r2-s6 · 17.2:r3 · 17.3 · 17.3:r1 · 17.3:r1-s1 · 17.3:r1-s4 · 17.3:r2 · 17.3:r2-s1 · 17.3:r2-s2 · 17.3:r2-s3 · 17.3:r2-s4 · 17.3:r3 · 17.3:r3-s1 · 17.3:r3-s2 · 17.3:r3-s3 · 17.3:r3-s4 · 17.4 · 17.4:r1 · 17.4:r1-s1 · 17.4:r1-s2 · 17.4:r1-s3 · 17.4:r1-s4 · 17.4:r1-s5 · 17.4:r1-s6 · 17.4:r2 · 17.4:r2-s1 · 17.4:r2-s2 · 17.4:r2-s3 · 17.4:r2-s4 · 17.4:r2-s5 · 18.1 · 18.1:r1 · 18.1:r2 · 18.1:r2-s1 · 18.1:r2-s2 · 18.1:r2-s4 · 18.1:r3 · 18.1:r3-s1 · 18.1:r3-s2 · 18.1:r3-s3 · 18.2 · 18.2:r1 · 18.2:r1-s2 · 18.2:r1-s3 · 18.2:r1-s4 · 18.2:r2 · 18.2:r2-s1 · 18.2:r2-s2 · 18.3 · 18.3:r1 · 18.3:r1-s1 · 18.3:r1-s2 · 18.4 · 18.4:r1 · 18.4:r1-s1 · 18.4:r1-s2
nvd oracle enterprise communications broker generic ≤ 2.0.0

References

URLTags
http://packetstormsecurity.com/files/131157/Appweb-Web-Server-Denial-Of-Service.html Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Apr/19 Mailing List, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Mar/158 Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/03/28/2 Mailing List, Patch
http://www.openwall.com/lists/oss-security/2015/04/06/2 Mailing List, Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
http://www.securityfocus.com/archive/1/535028/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/archive/1/535028/100/1400/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/73407 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037007 Broken Link, Third Party Advisory, VDB Entry

Timeline
Published2015-03-31By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.