CVE-2006-6104

published 2006-12-21

CVE-2006-6104: The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read…

Priority P4 30 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	mono	< mono 1.2.2.1-1 (bookworm)	mono 1.2.2.1-1 (bookworm)
mono	mono	>= 0 < 1.2.2.1-1	1.2.2.1-1
mono	mono	>= 0 < 1.2.2.1-1	1.2.2.1-1
mono	mono	>= 0 < 1.2.2.1-1	1.2.2.1-1
mono	mono	>= 0 < 1.2.2.1-1	1.2.2.1-1
mono	xsp	—	—
mono	xsp	—	—
mono	xsp	—	—

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 5.0 MEDIUM

vendor_debian 5.0 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.