CVE-2020-12872

概要

参考情報

• erlyaws/yaws · Exploit
• erlyaws/yaws · Issue Tracking
• erlyaws/yaws release · Release Notes
• medium.com/%40charlielabs101/cve-2020-12872-df315411aa70
• sweet32.info · Third Party Advisory

yaws のその他の脆弱性

• CVE-2020-24916緊急 9.8CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
• CVE-2020-24379緊急 9.8WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
• CVE-2016-1000108中 6.1yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications fr…
• CVE-2011-4350中 6.5Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to …
• CVE-2017-10974高 7.5Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about…