What’s Vulnerable › Vulnerabilities

CVE-2014-5015

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-07-24 · updated 2026-06-17
• Weakness: CWE-264

Description

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Affected products

• Eterna Bozohttpd: through 20140201; 19990519, 20000421, 20000426, 20000427, 20000815, 20000825 (+29)
• Netbsd: 5.1, 5.2, 6.0, 6.1

References

• http://seclists.org/oss-sec/2014/q3/180
• http://www.eterna.com.au/bozohttpd/
• http://www.eterna.com.au/bozohttpd/CHANGES
• http://www.osvdb.org/109283
• http://www.securityfocus.com/bid/68752
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94751
• http://seclists.org/oss-sec/2014/q3/180
• http://www.eterna.com.au/bozohttpd/
• http://www.eterna.com.au/bozohttpd/CHANGES
• http://www.osvdb.org/109283

Get alerted when CVE-2014-5015 or the next vulnerability affects your stack