UBUNTU-CVE-2020-24916: Command Injection
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.2-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.4+dfsg-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/yawsto a version that resolves this vulnerability.Fixed in 2.0.7+dfsg-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerability is network-reachable and requires no privileges or user interaction, according to the CVSS vector. Exploitation targets the CGI implementation in affected Yaws versions.
Which deployments are affected?
Yaws web server versions 1.81 through 2.0.7 are identified as vulnerable when using its CGI implementation. The provided data does not establish whether CGI is enabled by default.
What is the potential impact of successful exploitation?
Successful OS command injection can allow an attacker to execute operating-system commands. The CVSS assessment indicates high impact to confidentiality, integrity, and availability.