CVE-2006-6104

2006-12-2119:28:00

redhat

web.nvd.nist.gov

cve-2006-6104

nvd

system.web

xsp

asp.net

mono

security vulnerability

source code disclosure

credentials disclosure

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

0.074

Percentile

94.2%

JSON

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

Affected configurations

Nvd

Node

monoxspMatch1.1

monoxspMatch1.2.1

monoxspMatch2.0

VendorProductVersionCPE
monoxsp1.1cpe:2.3:a:mono:xsp:1.1:*:*:*:*:*:*:*
monoxsp1.2.1cpe:2.3:a:mono:xsp:1.2.1:*:*:*:*:*:*:*
monoxsp2.0cpe:2.3:a:mono:xsp:2.0:*:*:*:*:*:*:*