PT-2000-1832 · Boa · Boa Web Server

Publicado

2000-12-19

·

Atualizado

2017-10-10

·

CVE-2000-0920

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions BOA web server versions 0.94.8.2 and earlier
Description A directory traversal issue allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request. This is achieved by using a "%2E" instead of a "." in the request.
Recommendations For BOA web server versions 0.94.8.2 and earlier, consider restricting access to sensitive files and directories until a patch is available. As a temporary workaround, disabling the use of "%2E" in GET HTTP requests may help minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2000-0920

Produtos afetados

Boa Web Server