CVE-2017-10974: Path Traversal
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on this product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10974?
CVE-2017-10974 is classified as a medium severity vulnerability due to its potential for unauthorized remote file disclosure.
How do I fix CVE-2017-10974?
To fix CVE-2017-10974, update Yaws to the latest version or apply patches that address this directory traversal vulnerability.
What versions of Yaws are affected by CVE-2017-10974?
CVE-2017-10974 affects Yaws version 1.91.
What type of vulnerability is CVE-2017-10974?
CVE-2017-10974 is a remote file disclosure vulnerability caused by HTTP directory traversal.
Can CVE-2017-10974 be exploited without authentication?
Yes, CVE-2017-10974 can be exploited without authentication, allowing unauthenticated users to access sensitive files.