p PatchFirst

CVE-2006-6104

CVE-2006-6104

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

EPSS 5.2% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mono Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.2.2.1-1

    Update to 1.2.2.1-1

  • mono Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.2.1-1

    Update to 1.2.2.1-1

  • mono Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.2.1-1

    Update to 1.2.2.1-1

Original sources

Check your server →