Test ID:	10465
Category:	CGI abuses
Title:	CVSWeb 1.80 gives a shell to cvs committers
Summary:	NOSUMMARY
Description:	Description: The remote cvsweb is older or as old as version 1.85. This version allows a cvs committer to execute arbitrary commands on your server, with the privileges of the HTTPd process. Solution : upgrade to version 1.86 (http://stud.fh-heilbronn.de/~ zeller/cgi/cvsweb.cgi/) Risk factor : High
Cross-Ref:	BugTraq ID: 1469 Common Vulnerability Exposure (CVE) ID: CVE-2000-0670 http://www.securityfocus.com/bid/1469 Bugtraq: 20000712 cvsweb: remote shell for cvs committers (Google Search) http://archives.neohapsis.com/archives/bugtraq/2000-07/0178.html Bugtraq: 20000714 MDKSA-2000:019 cvsweb update (Google Search) http://archives.neohapsis.com/archives/bugtraq/2000-07/0196.html Debian Security Information: 20000719b (Google Search) FreeBSD Security Advisory: FreeBSD-SA-00:37 ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:37.cvsweb.asc TurboLinux Advisory: TLSA2000016-1 http://www.turbolinux.com/pipermail/tl-security-announce/2000-August/000015.html XForce ISS Database: cvsweb-shell-access(4925) https://exchange.xforce.ibmcloud.com/vulnerabilities/4925
Copyright	This script is Copyright (C) 2000 Renaud Deraison

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.