PT-2001-2047 · Acme · Acme Thttpd Secure Webserver

Published 2001-11-13 · Updated 2021-09-13 · CVE-2001-0892

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acme Thttpd Secure Webserver versions prior to 2.22

Description The issue allows remote attackers to view sensitive files under the document root, such as .htpasswd, via a GET request with a trailing /. This is possible when the chroot option is enabled.

Recommendations For versions prior to 2.22, consider disabling the chroot option as a temporary workaround until a patch is available. Restrict access to sensitive files under the document root to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2001-0892

Affected Products

Acme Thttpd Secure Webserver

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2001-0892 · Security Note
• http://acme.com/software/thttpd · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0892 · Note
• http://marc.info/?l=bugtraq&m=100568999726036&w=2 · Note