Description
Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.
References (9)
Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25178
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/23836
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/0937
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1015779
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/17123
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/427478/100/0/threaded
Patch, Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2006-13/advisory
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/576
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18962
Scores
EPSS
0.0112
EPSS Percentile
78.5%
Details
Status
published
Products (1)
gnome/dwarf_http_server
1.3.2
Published
Mar 13, 2006
Tracked Since
Feb 18, 2026