PT-2001-2125 · Orbis Gmbh · Bscw

Publicado 2001-08-31 · Atualizado 2008-09-05 · CVE-2001-0973

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BSCW groupware system versions 3.3 through 4.0.2 beta

Description The issue allows remote attackers to read or modify arbitrary files. This is achieved by uploading and extracting a tar file with a symlink into the data-bag space.

Recommendations For versions 3.3 through 4.0.2 beta, consider restricting access to the file upload feature to prevent exploitation until a fix is available. As a temporary workaround, avoid using the data-bag space for sensitive files.

Correção

Identificadores relacionados

CVE-2001-0973

Produtos afetados

Bscw

Referências · 6

• http://kb.cert.org/vuls/id/465971 · Nota
• http://securityfocus.com/bid/3227 · Nota
• http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txt · Aviso do Fabricante
• http://iss.net/security_center/static/7029.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0973 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2001-08/0328.html · Aviso do Fabricante