CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24916
Reference (s):
- DEBIAN:DSA-4773
- URL: https://www.debian.org/security/2020/dsa-4773
- https://github.com/erlyaws/yaws/commits/master
- https://github.com/vulnbe/poc-yaws-cgi-shell-injection
- https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html