Description

darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.

Is your site exposed to CVE-2024-23770?

Run a free security scan — no signup, results in seconds.

Scan my site

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
unix4lyfe	darkhttpd	< 1.15

References

Advisories & Patches

https://github.com/emikulic/darkhttpd/commit/2b339828b2a42a5fda105ea84934957a7d23e35d https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15 https://github.com/emikulic/darkhttpd/commit/2b339828b2a42a5fda105ea84934957a7d23e35d https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15

Other References

http://www.openwall.com/lists/oss-security/2024/01/25/1 http://www.openwall.com/lists/oss-security/2024/01/25/1

Frequently Asked Questions

What is CVE-2024-23770? +

darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-23770? +

CVE-2024-23770 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-23770? +

CVE-2024-23770 affects products from unix4lyfe, specifically: darkhttpd. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23770? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-23771 9.8

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers …