Summary
Yaws is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.
Attackers can exploit this issue to execute arbitrary commands in a terminal.
Yaws 1.85 is vulnerable
other versions may also be affected.
References
Severity
Classification
-
CVE CVE-2009-4495 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities
- Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
- CUPS Information Disclosure Vulnerability
- HTTP File Server Security Bypass and Denial of Service Vulnerabilities
- IBM HTTP Server Multiple Cross Site Scripting Vulnerabilities
- Apache Tomcat Hash Collision Denial Of Service Vulnerability