CVE-2005-0316 json
WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external system…
published 2005-01-28 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0317
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.2%
- EPSS 8.2% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Exploit-DB
Summary
WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
Patch / fix
- secunia.com/advisories/14058 advisory
- securityfocus.com/bid/12394 advisory
Timeline
- First public exploit (EDB-25066)
- Published
Exploit prediction
8.23% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-25066 WebWasher Classic 2.2/2.3 - HTTP CONNECT Unauthorized Access remote, 2005-01-28
- oliverkarow.de http://www.oliverkarow.de/research/WebWasherCONNECT.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/14058
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/12394
vdb-entry, patch, vendor-advisory
-
oliverkarow.de
/research/WebWasherCONNECT.txt
exploit, vendor-advisory
-
marc.info
/?l=bugtraq&m=110693045507245&w=2
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/19144
vdb-entry
-
securitytracker.com
/id?1013036
vdb-entry
Sources
- CVE List CVE-2005-0316
- NVD CVE-2005-0316
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.