Unscored severity · published Dec 21, 2006
CVE-2006-6104
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by…
–
CVSS
5.2%
EPSS
No
On KEV
Description
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XS
Xsp · Mono
1.1; 1.2.1; 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6104
fedoranews.org
http://fedoranews.org/cms/node/2400
fedoranews.org
http://fedoranews.org/cms/node/2401
lists.suse.com
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html
Exploit
http://secunia.com/advisories/23432
Patch
http://secunia.com/advisories/23435
Patch
http://secunia.com/advisories/23462
More from Xsp
–
CVE-2006-2658
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote…