PT-2020-5795 · Yaws+1 · Yaws Webserver+1

Published 2020-08-17 · Updated 2025-12-25 · CVE-2020-24379

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Yaws web server versions 1.81 through 2.0.7

Description: The issue is related to the implementation of WebDAV in the Yaws web server, which is vulnerable to XXE injection. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations: For Yaws web server versions 1.81 through 2.0.7, update to a version that is not affected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-01757

CVE-2020-24379

DLA-2384-1

DSA-4773-1

USN-4569-1

Affected Products

Ubuntu

Yaws Webserver

References · 22

• 🔥 https://github.com/vulnbe/poc-yaws-cgi-shell-injection · Exploit
• 🔥 https://github.com/vulnbe/poc-yaws-dav-xxe · Exploit
• 🔥 https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html · Exploit
• https://github.com/erlyaws/yaws/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-24379 · Security Note
• https://ubuntu.com/security/CVE-2020-24379 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24379 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24916 · Vendor Advisory
• https://usn.ubuntu.com/4569-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24379 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24379 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01757 · Security Note
• https://osv.dev/vulnerability/USN-4569-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4773 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4773-1 · Vendor Advisory