CVE-2014-5015

Loading...

General

Score:5.0/10.0
Severity:Medium
Category:Access Control Error
Exploit:Available

Impact Metrics

Confidentiality:Partial
Integrity:None
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:None

Relative vulnerabilities

CVE-2015-8212

Published on 24/07/14 - Updated on 29/08/17

Description

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Category: Access Control Error

CWE-264 (Permissions, Privileges, and Access Control)
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Security Notices

US National Vulnerability DatabaseCVE-2014-5015
Debian LTSDLA-490-1

Exploits

SecurityFocusBID-68752

Relative technologies

VendorProduct
eternabozohttpd
netbsdnetbsd

Share this vulnerability with:

Twitter Facebook LinkedIn Mail