critical9.8
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Impact
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yaws | Yaws | from 1.81 through 2.0.7 |
| Canonical | Ubuntu Linux | Version 18.04 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-cgi-shell-injection
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-cgi-shell-injection
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773