CVE-2019-20798 - CVE House
Back to Database
Status published High CVE-2019-20798

An XSS issue was discovered in handler_server_info.c in Cherokee through...

Vulnerability Description

An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20798

Credits & Attribution

No credits recorded in the NVD database.

References

More from cherokee-project

View All →
CVE-2020-12845
Cherokee 0.4.27 to 1.2.104 is affected by a denial of...
High 7.5
CVE-2019-20800
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds...
Critical 9.8
CVE-2019-20799
In Cherokee through 1.2.104, multiple memory corruption errors may be...
High 7.5
CVE-2011-2191
Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before...
Medium 6.8
CVE-2011-2190
The generate_admin_password function in Cherokee before 1.2.99 uses time and...
Low 2.1

Affected Vendor

cherokee-project

View all reports →

Affected Software

cherokee
Vulnerable Versions:
0

Timeline

Official Publish: May 17th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.