An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104.
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.
Why it matters now
EPSS 0.01654 76th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cherokee-project:cherokee:*:*:*:*:*:*:*:* | up to 1.2.104 | Vulnerable | Cherokee-project |
- cpe:2.3:a:cherokee-project:cherokee:*:*:*:*:*:*:*:* Versions up to 1.2.104 Vulnerable ·Cherokee-project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-20798
- 2026-10-03 Alias added: GHSA-926v-x6q7-4hcv
References
More Cherokee-project Cherokee vulnerabilities
- TI-2019-15018 In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in… CVSS 3.1CRITICAL 9.8
- TI-2020-10210 Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer… CVSS 3.1HIGH 7.5
- TI-2019-15017 In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote… CVSS 3.1HIGH 7.5
- TI-2014-03847 The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and… CVSS 2.0MEDIUM 6.8
- TI-2009-04250 header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing… CVSS 2.0MEDIUM 5.0
- TI-2011-01913 Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2019-20798 · CVE Program
- CVE-2019-20798 · NVD
- FIRST EPSS
- GHSA-926v-x6q7-4hcv · GitHub Advisory Database · CC BY 4.0
- CVE-2019-20798 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences