CVE-2006-6104

2006-12-2119:28:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.074

Percentile

94.2%

JSON

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

Affected configurations

Nvd

Node

monoxspMatch1.1

monoxspMatch1.2.1

monoxspMatch2.0

VendorProductVersionCPE
monoxsp1.1cpe:2.3:a:mono:xsp:1.1:*:*:*:*:*:*:*
monoxsp1.2.1cpe:2.3:a:mono:xsp:1.2.1:*:*:*:*:*:*:*
monoxsp2.0cpe:2.3:a:mono:xsp:2.0:*:*:*:*:*:*:*