Information disclosure in Htdig Project

CVE-2000-1191

htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path.

EPSS: 0.030 (86.2th percentile) — read the EPSS interpretation.

Affected products

Htdig_project Htdig — versions 3.2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_OVAL, signature, Third Party Advisory, vdb-entry)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
cve@mitre.org (x_refsource_MISC, Broken Link)