CVE-2006-4110 Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive S...
MediumCVSS 4.3
EPSS 40.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 2.0.58 | No fix listed |
| Apache HTTP Server | = 2.2.2 | No fix listed |
| Apache HTTP Server | = 2.2.3 | No fix listed |
References
- Debian Security Tracker CVE-2006-4110 vendor-advisory
- 21490 exploit third-party-advisory vendor-advisory
- 1370 third-party-advisory
- 27913 vdb-entry
- 20060809 CGI Script Source Code Disclosure Vulnerability in Apache for Windows mailing-list
- 20060817 Re: Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows mailing-list
- 19447 exploit vdb-entry
- ADV-2006-3265 vdb-entry
- apache-modalias-information-disclosure(28357) vdb-entry