PT-2006-1866 · Dwarf · Dwarf Http Server

Tan Chew Keong · Published 2006-03-13 · Updated 2018-10-18 · CVE-2006-0819

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dwarf HTTP Server version 1.3.2

Description The issue allows remote attackers to obtain the source code of JSP files by manipulating the filename extension in an HTTP request with specific characters, including dot, space, slash, or NULL characters.

Recommendations For Dwarf HTTP Server version 1.3.2, update to a newer version that addresses this issue, as using specific characters in the filename extension of an HTTP request can lead to exposure of JSP source code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-0819

Affected Products

Dwarf Http Server

References · 10

• http://secunia.com/advisories/18962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0819 · Security Note
• http://secunia.com/secunia_research/2006-13/advisory · Vendor Advisory
• http://securityfocus.com/archive/1/427478/100/0/threaded · Note
• http://securityfocus.com/bid/17123 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25178 · Note
• http://vupen.com/english/advisories/2006/0937 · Note
• http://osvdb.org/23836 · Note
• http://securitytracker.com/id?1015779 · Note
• http://securityreason.com/securityalert/576 · Note