CVE-2005-0316 Auth bypass in n/a
Remote attackers can bypass access restrictions in WebWasher server mode by sending CONNECT requests to localhost, potentially accessing restricted resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-0316?
CVE-2005-0316 is a high-severity authentication bypass vulnerability in n/a, published on 10 Feb 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
Which versions are affected by CVE-2005-0316?
It affects 1 product.
Products include Webwasher Webwasher Classic.
How do I fix CVE-2005-0316?
No fix has been published for CVE-2005-0316 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2005-0316 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-0316 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-rhrp-h4q5-hrfx.