CVE-2020-24916: OS Command Injection
Published Sep 9, 2020
·Updated
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Affected Software
5 affected componentsFixes available
Yaws Yaws>=1.81<=2.0.7
Canonical Ubuntu Linux=18.04
Debian Debian Linux=9.0
Debian Debian Linux=10.0
debian/yaws
2.0.8+dfsg-32.1.1+dfsg-22.2.0+dfsg-2
Remediation
Patch Available
Event History
Sep 9, 2020
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
Description
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 4, 2024
Data Sourced
via Launchpad·03:18 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·09:17 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·09:18 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-24916?
CVE-2020-24916 is classified as a high-severity vulnerability due to its potential for OS command injection.
2
How do I fix CVE-2020-24916?
To fix CVE-2020-24916, upgrade to Yaws versions 2.0.8 or later.
3
Which versions of Yaws are affected by CVE-2020-24916?
Yaws web server versions from 1.81 to 2.0.7 are affected by CVE-2020-24916.
4
Can CVE-2020-24916 lead to unauthorized access?
Yes, CVE-2020-24916 can potentially allow attackers to execute arbitrary OS commands, leading to unauthorized access.
5
What platforms are impacted by CVE-2020-24916?
CVE-2020-24916 affects systems running Yaws on both Debian and Ubuntu platforms.