Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-5015

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Published

2014-07-24T14:55:09.583

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application eterna bozohttpd ≤ 20140201 Yes
Application eterna bozohttpd 19990519 Yes
Application eterna bozohttpd 20000421 Yes
Application eterna bozohttpd 20000426 Yes
Application eterna bozohttpd 20000427 Yes
Application eterna bozohttpd 20000815 Yes
Application eterna bozohttpd 20000825 Yes
Application eterna bozohttpd 20010610 Yes
Application eterna bozohttpd 20010812 Yes
Application eterna bozohttpd 20010922 Yes
Application eterna bozohttpd 20020710 Yes
Application eterna bozohttpd 20020730 Yes
Application eterna bozohttpd 20020803 Yes
Application eterna bozohttpd 20020804 Yes
Application eterna bozohttpd 20020823 Yes
Application eterna bozohttpd 20020913 Yes
Application eterna bozohttpd 20021106 Yes
Application eterna bozohttpd 20030313 Yes
Application eterna bozohttpd 20030409 Yes
Application eterna bozohttpd 20030626 Yes
Application eterna bozohttpd 20031005 Yes
Application eterna bozohttpd 20040218 Yes
Application eterna bozohttpd 20040808 Yes
Application eterna bozohttpd 20050410 Yes
Application eterna bozohttpd 20060517 Yes
Application eterna bozohttpd 20060710 Yes
Application eterna bozohttpd 20080303 Yes
Application eterna bozohttpd 20090417 Yes
Application eterna bozohttpd 20090522 Yes
Application eterna bozohttpd 20100509 Yes
Application eterna bozohttpd 20100512 Yes
Application eterna bozohttpd 20100617 Yes
Application eterna bozohttpd 20100621 Yes
Application eterna bozohttpd 20100920 Yes
Application eterna bozohttpd 20111118 Yes
Application eterna bozohttpd 20140102 Yes
Operating System netbsd netbsd 5.1 Yes
Operating System netbsd netbsd 5.2 Yes
Operating System netbsd netbsd 6.0 Yes
Operating System netbsd netbsd 6.1 Yes
References