Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows...
Vulnerability Description
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-6405
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/484761/100/0/threaded
- http://securityreason.com/securityalert/3457
- https://www.exploit-db.com/exploits/4700
- http://osvdb.org/44119
- http://www.securityfocus.com/bid/26768
- http://sourceforge.net/mailarchive/forum.php?thread_name=20071203130540.6e482c20.aluigi%40autistici.org&forum_name=shttpd-general
- http://aluigi.altervista.org/adv/shttpd-adv.txt
Affected Vendor
shttpd
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.