Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

medium Nessus Plugin ID 23934

Language:

Synopsis

The remote web server is affected by an information disclosure vulnerability.

Description

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications.

The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scripts hosted by the affected application using specially crafted requests with URL-encoded space characters.

Solution

Upgrade to Mono version 1.2.2 / 1.1.13.8.2 or later.

Plugin Details

Severity: Medium

ID: 23934

File Name: mono_xsp_source_disclosure.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 12/23/2006

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 12/20/2006

Reference Information

CVE: CVE-2006-6104

BID: 21687

Detections

Analytics