Login Request a demo
Unscored severity · published Dec 29, 2001
CVE-2001-1433
Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via other vulnerabilities
–
CVSS
3.4%
EPSS
No
On KEV
Description
Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via other vulnerabilities.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cherokee Httpd · Cherokee
0.1; 0.1.5; 0.1.6; 0.2; 0.2.5; 0.2.6 · source: NVD
Affected product
CH
Cherokee Httpd
Cherokee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1433
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1433
Exploit
http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0085.html
US Government Resource
http://www.kb.cert.org/vuls/id/245795
Exploit
http://www.securityfocus.com/bid/3771
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/7797
More from Cherokee Httpd
–
CVE-2009-3902
Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\
–
CVE-2006-1681
Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an…
–
CVE-2004-1097
Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a…
–
CVE-2004-2171
Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the…
–
CVE-2004-1946
Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string…