This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Cherokee-Project First view 2011-10-06
Product Cherokee Last view 2020-07-27
Version 1.0.18 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:cherokee-project:cherokee

Activity : Overall

Related : CVE

  Date Alert Description
7.5 2020-07-27 CVE-2020-12845

Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.

9.8 2020-05-18 CVE-2019-20800

In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.

7.5 2020-05-18 CVE-2019-20799

In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.

8.4 2020-05-18 CVE-2019-20798

An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.

6.8 2014-07-02 CVE-2014-4668

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

6.8 2011-10-06 CVE-2011-2191

Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply.

2.1 2011-10-06 CVE-2011-2190

The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.

CWE : Common Weakness Enumeration

%idName
28% (2) CWE-787 Out-of-bounds Write
14% (1) CWE-476 NULL Pointer Dereference
14% (1) CWE-352 Cross-Site Request Forgery (CSRF)
14% (1) CWE-310 Cryptographic Issues
14% (1) CWE-287 Improper Authentication
14% (1) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')

Open Source Vulnerability Database (OSVDB)

id Description
75717 Cherokee Admin Password Generation Weakness Password Disclosure
72693 Cherokee Admin Interface Arbitrary Command Execution CSRF

OpenVAS Exploits

id Description
2012-04-02 Name : Fedora Update for cherokee FEDORA-2011-12657
File : nvt/gb_fedora_2011_12657_cherokee_fc16.nasl
2012-04-02 Name : Fedora Update for cherokee FEDORA-2011-14622
File : nvt/gb_fedora_2011_14622_cherokee_fc16.nasl
2011-11-25 Name : Fedora Update for cherokee FEDORA-2011-14634
File : nvt/gb_fedora_2011_14634_cherokee_fc15.nasl
2011-11-25 Name : Fedora Update for cherokee FEDORA-2011-14660
File : nvt/gb_fedora_2011_14660_cherokee_fc14.nasl
2011-09-27 Name : Fedora Update for cherokee FEDORA-2011-12687
File : nvt/gb_fedora_2011_12687_cherokee_fc14.nasl
2011-09-27 Name : Fedora Update for cherokee FEDORA-2011-12698
File : nvt/gb_fedora_2011_12698_cherokee_fc15.nasl

Nessus® Vulnerability Scanner

id Description
2015-05-05 Name: The remote Mandriva Linux host is missing one or more security updates.
File: mandriva_MDVSA-2015-225.nasl - Type: ACT_GATHER_INFO
2015-04-28 Name: The remote Fedora host is missing a security update.
File: fedora_2015-6279.nasl - Type: ACT_GATHER_INFO
2015-04-28 Name: The remote Fedora host is missing a security update.
File: fedora_2015-6392.nasl - Type: ACT_GATHER_INFO
2015-04-23 Name: The remote Fedora host is missing a security update.
File: fedora_2015-6194.nasl - Type: ACT_GATHER_INFO
2011-11-26 Name: The remote Fedora host is missing a security update.
File: fedora_2011-14622.nasl - Type: ACT_GATHER_INFO
2011-11-26 Name: The remote Fedora host is missing a security update.
File: fedora_2011-14634.nasl - Type: ACT_GATHER_INFO
2011-11-26 Name: The remote Fedora host is missing a security update.
File: fedora_2011-14660.nasl - Type: ACT_GATHER_INFO
2011-10-03 Name: The remote Fedora host is missing a security update.
File: fedora_2011-12657.nasl - Type: ACT_GATHER_INFO
2011-09-26 Name: The remote Fedora host is missing a security update.
File: fedora_2011-12687.nasl - Type: ACT_GATHER_INFO
2011-09-26 Name: The remote Fedora host is missing a security update.
File: fedora_2011-12698.nasl - Type: ACT_GATHER_INFO