Unscored severity · published Nov 4, 2010
CVE-2010-4181
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences
–
CVSS
8.5%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
Yaws · Yaws
1.89 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4181
osvdb.org
http://osvdb.org/68962
Vendor Advisory
http://secunia.com/advisories/42066
Exploit
http://www.exploit-db.com/exploits/15371
www.securityfocus.com
http://www.securityfocus.com/bid/44564
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2858
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/62917
More from Yaws
9.8
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection
9.8
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection
7.5
CVE-2017-10974
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080
6.5
CVE-2011-4350
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed
6.1
CVE-2016-1000108
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…