CVE-2006-6104: Medium severity Mono xsp vulnerability
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6104?
CVE-2006-6104 is classified as a medium severity vulnerability due to its potential for exposing sensitive data.
How do I fix CVE-2006-6104?
To fix CVE-2006-6104, you should upgrade to a patched version of Mono Xsp that addresses this local pathname verification issue.
What types of attacks can CVE-2006-6104 be exploited for?
CVE-2006-6104 can be exploited to read source code and sensitive configuration files such as Web.Config by manipulating URIs.
Which versions of Mono Xsp are affected by CVE-2006-6104?
CVE-2006-6104 affects Mono Xsp versions 1.1, 1.2.1, and 2.0.
What is the impact of not addressing CVE-2006-6104?
Not addressing CVE-2006-6104 can lead to unauthorized access to sensitive information, including application source code and credentials.