The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://security.gentoo.org/glsa/glsa-200701-12.xml | vendor-advisory x_refsource_GENTOO x_transferred |
| http://secunia.com/advisories/23597 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.vupen.com/english/advisories/2006/5099 | vdb-entry x_refsource_VUPEN x_transferred |
| http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html | vendor-advisory x_refsource_SUSE x_transferred |
| http://securityreason.com/securityalert/2082 | third-party-advisory x_refsource_SREASON x_transferred |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2092 | vdb-entry signature x_refsource_OVAL x_transferred |
| http://www.securityfocus.com/archive/1/454962/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://securitytracker.com/id?1017430 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://fedoranews.org/cms/node/2400 | vendor-advisory x_refsource_FEDORA x_transferred |
| http://secunia.com/advisories/23462 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/23727 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/23779 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.mandriva.com/security/advisories?name=MDKSA-2006:234 | vendor-advisory x_refsource_MANDRIVA x_transferred |
| http://secunia.com/advisories/23776 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.securityfocus.com/bid/21687 | vdb-entry x_refsource_BID x_transferred |
| http://www.eazel.es/advisory007-mono-xsp-source-disclosure-vulnerability.html | x_refsource_MISC x_transferred |
| http://secunia.com/advisories/23435 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/23432 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://fedoranews.org/cms/node/2401 | vendor-advisory x_refsource_FEDORA x_transferred |
| http://www.ubuntu.com/usn/usn-397-1 | vendor-advisory x_refsource_UBUNTU x_transferred |