CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read…

published December 21, 2006

CVSS
—
EPSS
5%
Percentile
92.5
In the wild
Unconfirmed
What it is

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05248 · 92.5th percentile
Published
2006-12-21T19:00Z
EPSS history
Timeline
  • 21 DEC 19:00Z
    The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read…
    cvelistv5