Description
Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.
References
- ADV-2006-0937 vdb-entry
- 1015779 vdb-entry
- 17123 vdb-entry
- dwarfhttp-extension-information-disclosure(25178) vdb-entry
- 20060313 Secunia Research: Dwarf HTTP Server Source Disclosure andCross-Site Scripting mailing-list
- http://secunia.com/secunia_research/2006-13/advisory
- 23836 vdb-entry
- 576 third-party-advisory
- 18962 third-party-advisory