CVE-2019-20798

 

Published at: - 18-05-2020 02:15

Last modified: - 21-11-2022 09:33

Total changes: - 2

Description

An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://logicaltrust.net/blog/2019/11/cherokee.html
• https://github.com/cherokee/webserver/issues/1227
• GLSA-202012-09-Third Party Advisory

 

Keywords

NVD

 

CVE-2019-20798

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures