Strix
26.1K

CVE-2014-5015

UnknownEPSS 1.74%

Last modified

CVE-2014-5015 is a vulnerability of currently unknown severity. bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.. EPSS estimates a 1.74% chance of exploitation in the next 30 days.

Description

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Metrics

EPSS Probability
1.74%

74.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
EternaBozohttpd<= 20140201
EternaBozohttpd19990519
EternaBozohttpd20000421
EternaBozohttpd20000426
EternaBozohttpd20000427
EternaBozohttpd20000815
EternaBozohttpd20000825
EternaBozohttpd20010610
EternaBozohttpd20010812
EternaBozohttpd20010922
EternaBozohttpd20020710
EternaBozohttpd20020730
EternaBozohttpd20020803
EternaBozohttpd20020804
EternaBozohttpd20020823
EternaBozohttpd20020913
EternaBozohttpd20021106
EternaBozohttpd20030313
EternaBozohttpd20030409
EternaBozohttpd20030626
EternaBozohttpd20031005
EternaBozohttpd20040218
EternaBozohttpd20040808
EternaBozohttpd20050410
EternaBozohttpd20060517
EternaBozohttpd20060710
EternaBozohttpd20080303
EternaBozohttpd20090417
EternaBozohttpd20090522
EternaBozohttpd20100509
EternaBozohttpd20100512
EternaBozohttpd20100617
EternaBozohttpd20100621
EternaBozohttpd20100920
EternaBozohttpd20111118
EternaBozohttpd20140102
NetbsdNetbsd5.1
NetbsdNetbsd5.2
NetbsdNetbsd6.0
NetbsdNetbsd6.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-5015?
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
How severe is CVE-2014-5015?
Severity scoring for CVE-2014-5015 is pending analysis. The EPSS model estimates a 1.74% probability of exploitation in the next 30 days.
How do I fix CVE-2014-5015?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2014

View all 2014CVEs →

Are you affected by CVE-2014-5015?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST