Login Request a demo
Unscored severity · published Sep 12, 2006
CVE-2006-2658
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Suse Linux · Suse
9.2; 9.2; 9.2; 9.3; 9.3; 9.3; +4 more · source: NVD
SO
Suse Open Enterprise Server · Suse
1 · source: NVD
XS
Xsp · Mono
All versions, or not specified · source: NVD
Affected product
XS
Xsp
Mono
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2658
Vendor Advisory
http://lists.suse.com/archive/suse-security-announce/2006-Sep/0005.html
Vendor Advisory
http://secunia.com/advisories/21840
secunia.com
http://secunia.com/advisories/21847
securitytracker.com
http://securitytracker.com/id?1016821
www.securityfocus.com
http://www.securityfocus.com/bid/19929
www.vupen.com
http://www.vupen.com/english/advisories/2006/3552
More from Xsp
–
CVE-2006-6104
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by…