PT-2001-2047 · Acme · Acme Thttpd Secure Webserver

Publicado 2001-11-13 · Atualizado 2021-09-13 · CVE-2001-0892

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acme Thttpd Secure Webserver versions prior to 2.22

Description The issue allows remote attackers to view sensitive files under the document root, such as .htpasswd, via a GET request with a trailing /. This is possible when the chroot option is enabled.

Recommendations For versions prior to 2.22, consider disabling the chroot option as a temporary workaround until a patch is available. Restrict access to sensitive files under the document root to minimize the risk of exploitation.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2001-0892

Produtos afetados

Acme Thttpd Secure Webserver

Referências · 4

• http://acme.com/software/thttpd · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0892 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0892 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=100568999726036&w=2 · Nota