CVE-2007-3009: Mbedthis Software Mbedthis Appweb HTTP Server

Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days.

Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the build supports logging but the configuration disables logging, allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in the HTTP scheme, as demonstrated by a "GET %n://localhost:80/" request.

Affected products

• Mbedthis Software Mbedthis Appweb HTTP Server: version 2.0.5-4 only

Published 2007-06-04. Last modified 2026-06-16.