PT-2024-20074 · Darkhttpd · Darkhttpd

Matthias Gerstner · Published 2024-01-21 · Updated 2026-03-29 · CVE-2024-23770

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions darkhttpd versions 1.15 and earlier

Description The issue allows local users to discover credentials by listing processes and their arguments. This is related to the --auth option.

Recommendations For darkhttpd versions 1.15 and earlier, consider restricting access to process listings to minimize the risk of credential discovery until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-23770

Affected Products

Darkhttpd

References · 14

• https://github.com/emikulic/darkhttpd/commit/2b339828b2a42a5fda105ea84934957a7d23e35d · Patch
• https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2024-23770 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-318-CVE-2024-23770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23770 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-319-CVE-2024-23770 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23770 · Vendor Advisory
• https://twitter.com/LimitedViewX/status/1751923240442716450 · Twitter Post
• https://twitter.com/CVEnew/status/1749275246018904094 · Twitter Post
• https://security.alpinelinux.org/vuln/CVE-2024-23770 · Note
• https://t.me/cvenotify/68183 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1749317884659052668 · Twitter Post
• http://openwall.com/lists/oss-security/2024/01/25/1 · Note
• https://t.me/cvenotify/68645 · Telegram Post