CVE-2006-6104

2006-12-2119:28:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.08 Low

EPSS

Percentile

94.3%

JSON

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

OSVersionArchitecturePackageVersionFilename
Debian12allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian11allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian999allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian13allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	11	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	999	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	13	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb