Unscored severity · published Aug 2, 2010
CVE-2010-2320
bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple…
–
CVSS
2.4%
EPSS
No
On KEV
Description
bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple requests for URIs beginning with /~ sequences.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bozohttpd · Eterna
through 20100617; 19990519; 20000421; 20000426; 20000427; 20000815; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2320
Exploit
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298
Vendor Advisory
http://secunia.com/advisories/40737
security-tracker.debian.org
http://security-tracker.debian.org/tracker/CVE-2010-2320
www.eterna.com.au
http://www.eterna.com.au/bozohttpd/CHANGES
Exploit
https://bugs.launchpad.net/ubuntu/+source/bozohttpd/+bug/582473
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/60812
More from Bozohttpd
–
CVE-2014-5015
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP…
–
CVE-2010-2195
bozotic HTTP server (aka bozohttpd) 20090522 through 20100512 allows attackers to cause a denial of service via vectors related to a "wrong code generation interaction with GCC."