CVE-2005-2008 Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yaws webserver | = 1.50 | No fix listed |
| yaws webserver | = 1.51 | No fix listed |
| yaws webserver | = 1.52 | No fix listed |
| yaws webserver | = 1.53 | No fix listed |
| yaws webserver | = 1.54 | No fix listed |
| yaws webserver | = 1.55 | No fix listed |
| debian/yaws(Debian:12) | < 1.56-1 | 1.56-1 |
| debian/yaws(Debian:13) | < 1.56-1 | 1.56-1 |
| debian/yaws(Debian:14) | < 1.56-1 | 1.56-1 |
References
- 20050617 Source Code Disclosure in Yaws Webserver <1.56 mailing-list
- 15740 patch third-party-advisory vendor-advisory
- 17375 vdb-entry vendor-advisory
- yaws.hyber.org patch vendor-advisory
- Debian Security Tracker CVE-2005-2008 vendor-advisory