RaidenHTTPD Crafted Request Script Source Disclosure

medium Nessus Plugin ID 21015

Language:

Synopsis

The remote web server suffers from an information disclosure flaw.

Description

The remote host is running RaidenHTTPD, a web server for Windows.

According to its banner, the version of RaidenHTTPD installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scripts hosted by the affected application using specially crafted requests with dot, space, and slash characters.

Solution

Upgrade to RaidenHTTPD version 1.1.48 or later.

Plugin Details

Severity: Medium

ID: 21015

File Name: raidenhttpd_script_source_disclosure.nasl

Version: 1.15

Type: remote

Family: Web Servers

Published: 3/6/2006

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/3/2006

Reference Information

CVE: CVE-2006-0949

BID: 16934

Detections

Analytics