Lucene search
HistoryJul 24, 2014 - 2:55 p.m.
CVE-2014-5015
bozotic http server
cve-2014-5015
authentication bypass
remote attack
security vulnerability
nvd
netbsd
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
9.4 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.8%
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
Affected configurations
Node
eternabozohttpdRange≤20140201
OReternabozohttpdMatch19990519
OReternabozohttpdMatch20000421
OReternabozohttpdMatch20000426
OReternabozohttpdMatch20000427
OReternabozohttpdMatch20000815
OReternabozohttpdMatch20000825
OReternabozohttpdMatch20010610
OReternabozohttpdMatch20010812
OReternabozohttpdMatch20010922
OReternabozohttpdMatch20020710
OReternabozohttpdMatch20020730
OReternabozohttpdMatch20020803
OReternabozohttpdMatch20020804
OReternabozohttpdMatch20020823
OReternabozohttpdMatch20020913
OReternabozohttpdMatch20021106
OReternabozohttpdMatch20030313
OReternabozohttpdMatch20030409
OReternabozohttpdMatch20030626
OReternabozohttpdMatch20031005
OReternabozohttpdMatch20040218
OReternabozohttpdMatch20040808
OReternabozohttpdMatch20050410
OReternabozohttpdMatch20060517
OReternabozohttpdMatch20060710
OReternabozohttpdMatch20080303
OReternabozohttpdMatch20090417
OReternabozohttpdMatch20090522
OReternabozohttpdMatch20100509
OReternabozohttpdMatch20100512
OReternabozohttpdMatch20100617
OReternabozohttpdMatch20100621
OReternabozohttpdMatch20100920
OReternabozohttpdMatch20111118
OReternabozohttpdMatch20140102
ORnetbsdnetbsdMatch5.1
ORnetbsdnetbsdMatch5.2
ORnetbsdnetbsdMatch6.0
ORnetbsdnetbsdMatch6.1
Related
ubuntucve
ubuntucve
CVE-2014-5015
2014-07-24 00:00:00
nvd
nvd
CVE-2014-5015
2014-07-24 14:55:09
cvelist
cvelist
CVE-2014-5015
2014-07-24 14:00:00
prion
prion
Design/Logic Flaw
2014-07-24 14:55:00
osv
osv
bozohttpd - security update
2016-05-26 00:00:00
nessus
nessus
Debian DLA-490-1 : bozohttpd security update
2016-05-26 00:00:00
debian
debian
[SECURITY] [DLA 490-1] bozohttpd security update
2016-05-26 05:04:21
openvas
openvas
Debian: Security Advisory (DLA-490-1)
2023-03-08 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
9.4 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.8%
Related for CVE-2014-5015