PT-2006-1866 · Dwarf · Dwarf Http Server

Tan Chew Keong · Publicado 2006-03-13 · Atualizado 2018-10-18 · CVE-2006-0819

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dwarf HTTP Server version 1.3.2

Description The issue allows remote attackers to obtain the source code of JSP files by manipulating the filename extension in an HTTP request with specific characters, including dot, space, slash, or NULL characters.

Recommendations For Dwarf HTTP Server version 1.3.2, update to a newer version that addresses this issue, as using specific characters in the filename extension of an HTTP request can lead to exposure of JSP source code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-0819

Produtos afetados

Dwarf Http Server

Referências · 10

• http://securityfocus.com/archive/1/427478/100/0/threaded · Nota
• http://securityfocus.com/bid/17123 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25178 · Nota
• http://secunia.com/advisories/18962 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0819 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0937 · Nota
• http://secunia.com/secunia_research/2006-13/advisory · Aviso do Fabricante
• http://osvdb.org/23836 · Nota
• http://securitytracker.com/id?1015779 · Nota
• http://securityreason.com/securityalert/576 · Nota