CVE-2011-4350: Path Traversal
Published Nov 26, 2019
·Updated
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.
Affected Software
5 affected componentsFixes available
Yaws Yaws=1.91
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
debian/yaws
2.0.8+dfsg-32.1.1+dfsg-22.2.0+dfsg-2
Event History
Nov 26, 2019
CVE Published
via MITRE·04:49 AM
Data Sourced
via MITRE·04:49 AM
DescriptionWeakness
Feb 18, 2026
Data Sourced
via Debian·12:19 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-4350?
CVE-2011-4350 is classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive files.
2
How do I fix CVE-2011-4350?
To fix CVE-2011-4350, upgrade to Yaws versions 2.0.8+dfsg-3, 2.1.1+dfsg-2, or 2.2.0+dfsg-1.
3
Who is affected by CVE-2011-4350?
CVE-2011-4350 affects Yaws version 1.91 and may impact users of Debian GNU/Linux versions 8.0 to 10.0.
4
What causes the CVE-2011-4350 vulnerability?
CVE-2011-4350 is caused by a directory traversal vulnerability in the URL processing of the Yaws web server.
5
Can an attacker exploit CVE-2011-4350 remotely?
Yes, a remote authenticated user can exploit CVE-2011-4350 to read arbitrary local files from the server.