critical9.8
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
Impact
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yaws | Yaws | from 1.81 through 2.0.7 |
| Canonical | Ubuntu Linux | Version 18.04 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-dav-xxe
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-dav-xxe
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773