Vulnerability Note VU#124059
GoAhead WebServer information disclosure and authentication bypass vulnerabilities
GoAhead WebServer contains vulnerabilities that may allow an attacker to view source files containing sensitive information or bypass authentication. The information disclosure vulnerability was previously published as VU#975041.
GoAhead WebServer contains vulnerabilities handling file requests. By sending the web server a specially crafted URL, an attacker may be able to view the source files containing sensitive information or bypass authentication. GoAhead WebServer has a history of source file disclosure vulnerabilities.
An attacker may be able to view any file on the web server, including files that contain sensitive information like usernames and passwords. An attacker may also be able to bypass authentication for protected files.
Release notes for GoAhead WebServer 2.1.8 indicate that these vulnerabilities have been addressed. GoAhead WebServer is not being actively maintained. Vendors who redistribute GoAhead WebServer or include it in other products may release updates to address these vulnerabilities. Vendors who have modified GoAhead WebServer may or may not be affected. See the Systems Affected section below for more information.
GoAhead WebServer 2.1.8 on the Microsoft Windows platform remains vulnerable to source file disclosure.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|GoAhead Software, Inc.||Affected||-||22 Jun 2010|
|Rockwell Automation||Affected||-||29 Dec 2009|
CVSS Metrics (Learn More)
Thanks to Daniel Peck of Digital Bond, Inc. for reporting this issue.
This document was written by Ryan Giobbi.
- CVE IDs: CVE-2002-1603
- Date Public: 17 Dec 2002
- Date First Published: 05 Feb 2009
- Date Last Updated: 22 Jun 2010
- Severity Metric: 0.06
- Document Revision: 81
If you have feedback, comments, or additional information about this vulnerability, please send us email.