CVE-2019-20798

An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.

• CWE-79

• https://github.com/cherokee/webserver/issues/1227Exploit, Third Party Advisory
• https://logicaltrust.net/blog/2019/11/cherokee.htmlExploit, Third Party Advisory
• https://security.gentoo.org/glsa/202012-09Third Party Advisory
• https://github.com/cherokee/webserver/issues/1227Exploit, Third Party Advisory
• https://logicaltrust.net/blog/2019/11/cherokee.htmlExploit, Third Party Advisory
• https://security.gentoo.org/glsa/202012-09Third Party Advisory

Published

May 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20790OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-…9.8
• CVE-2019-20791OpenThread before 2019-12-13 has a stack-based buffer overfl…9.8
• CVE-2019-20792OpenSC before 0.20.0 has a double free in coolkey_free_priva…6.8
• CVE-2019-20794An issue was discovered in the Linux kernel 4.18 through 5.6…4.7
• CVE-2019-20795iproute2 before 5.1.0 has a use-after-free in get_netnsid_fr…4.4
• CVE-2019-20797An issue was discovered in e6y prboom-plus 2.5.1.5. There is…7.5
• CVE-2019-20799In Cherokee through 1.2.104, multiple memory corruption erro…7.5
• CVE-2019-2080In libxaac, there is a possible out of bounds write due to a…8.8
• CVE-2019-20800In Cherokee through 1.2.104, remote attackers can trigger an…9.8
• CVE-2019-20801An issue was discovered in the Readdle Documents app before …5.3
• CVE-2019-20802An issue was discovered in the Readdle Documents app before …6.1
• CVE-2019-20803Gila CMS before 1.11.6 has reflected XSS via the admin/conte…6.1