CVE-2020-24916
9.8
CRITICAL · CVSS 3.1 · EPSS 17.4% (pctl 97)
Patch early
EPSS 17.4% — above the 10% action threshold.
Description
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 17.37% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-09-09 |
| Last modified | 2026-06-17 |
Affected (3)
| Vendor | Product |
|---|---|
| canonical | ubuntu linux |
| debian | debian linux |
| yaws | yaws |
References
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-cgi-shell-injection
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-cgi-shell-injection
- https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html
- https://usn.ubuntu.com/4569-1/
- https://vuln.be/post/yaws-xxe-and-shell-injections/
- https://www.debian.org/security/2020/dsa-4773
→ the Explorer · watch your stack · NVD