CVE-1999-1053

Опубликовано: 13 сент. 1999

Источник: nvd

CVSS2: 7.5

EPSS Высокий

Описание

guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

Ссылки

http://www.securityfocus.com/archive/1/33674
Vendor Advisory
http://www.securityfocus.com/archive/82/27296
Exploit
Vendor Advisory
http://www.securityfocus.com/archive/82/27560
Vendor Advisory
http://www.securityfocus.com/bid/776
Exploit
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/33674
Vendor Advisory
http://www.securityfocus.com/archive/82/27296
Exploit
Vendor Advisory
http://www.securityfocus.com/archive/82/27560
Vendor Advisory
http://www.securityfocus.com/bid/776
Exploit
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*

cpe:2.3:a:matt_wright:matt_wright_guestbook:2.3:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.88012

Высокий

7.5 High

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-7fhv-p5jq-2v6f

github

больше 3 лет назад

guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".