CVE-2010-2320

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-08-02 · updated 2026-06-16
Weakness: CWE-264

Description

bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple requests for URIs beginning with /~ sequences.

Affected products

Eterna Bozohttpd: through 20100617; 19990519, 20000421, 20000426, 20000427, 20000815, 20000825 (+24)

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298
http://secunia.com/advisories/40737
http://security-tracker.debian.org/tracker/CVE-2010-2320
http://www.eterna.com.au/bozohttpd/CHANGES
https://bugs.launchpad.net/ubuntu/+source/bozohttpd/+bug/582473
https://exchange.xforce.ibmcloud.com/vulnerabilities/60812
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298
http://secunia.com/advisories/40737
http://security-tracker.debian.org/tracker/CVE-2010-2320
http://www.eterna.com.au/bozohttpd/CHANGES
https://bugs.launchpad.net/ubuntu/+source/bozohttpd/+bug/582473
https://exchange.xforce.ibmcloud.com/vulnerabilities/60812

Get alerted when CVE-2010-2320 or the next vulnerability affects your stack