High severity · published May 18, 2020
CVE-2019-20798
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104
8.4
CVSS
1.7%
EPSS
No
On KEV
Description
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cherokee · Cherokee-project
through 1.2.104 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20798
Exploit
https://github.com/cherokee/webserver/issues/1227
Exploit
https://logicaltrust.net/blog/2019/11/cherokee.html
Third Party Advisory
https://security.gentoo.org/glsa/202012-09
More from Cherokee
9.8
CVE-2019-20800
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as…
7.5
CVE-2020-12845
Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences
7.5
CVE-2019-20799
In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server
–
CVE-2014-4668
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which…
–
CVE-2011-2191
Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests…