PT-2001-1706 · Datawizard · Datawizard Webxq Server

Publicado 2001-06-27 · Atualizado 2017-10-10 · CVE-2001-0495

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: DataWizard WebXQ server version 1.204

Description: The issue allows remote attackers to view files outside of the web root via a .. (dot dot) attack, which is a type of directory traversal attack. This attack takes advantage of the fact that the .. notation can be used to access parent directories, potentially allowing access to sensitive files.

Recommendations: For DataWizard WebXQ server version 1.204, consider implementing proper input validation and sanitization to prevent directory traversal attacks, such as restricting access to files outside of the web root and limiting the use of the .. notation.

Exploit

Correção

Identificadores relacionados

CVE-2001-0495

Produtos afetados

Datawizard Webxq Server

Referências · 6

• 🔥 http://securityfocus.com/bid/2660 · Exploit
• 🔥 https://exploit-db.com/exploits/20807 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2001-04/0490.html · Aviso do Fabricante
• http://osvdb.org/1799 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0495 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6466 · Nota