RaidenHTTPD Crafted Request Script Source Disclosure

Medium Nessus Plugin ID 21015


The remote web server suffers from an information disclosure flaw.


The remote host is running RaidenHTTPD, a web server for Windows.

According to its banner, the version of RaidenHTTPD installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scripts hosted by the affected application using specially crafted requests with dot, space, and slash characters.


Upgrade to RaidenHTTPD version 1.1.48 or later.

See Also

Plugin Details

Severity: Medium

ID: 21015

File Name: raidenhttpd_script_source_disclosure.nasl

Version: $Revision: 1.13 $

Type: remote

Family: Web Servers

Published: 2006/03/06

Modified: 2011/09/02

Dependencies: 10107

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2006/03/03

Reference Information

CVE: CVE-2006-0949

BID: 16934

OSVDB: 23616