PT-2001-2293 · Baltimore Technologies · Websweeper

Publicado 2001-09-05 · Atualizado 2008-09-05 · CVE-2001-1152

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Baltimore Technologies WEBsweeper version 4.02

Description The issue allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL. This can be achieved through various methods, including using a // (double slash), a /SUBDIR/.. to access files in the parent directory, a /./, or URL-encoded characters.

Recommendations For version 4.02, consider implementing additional URL validation and sanitization to prevent attackers from bypassing blacklist restrictions. As a temporary workaround, restrict access to sensitive web servers and monitor URL requests for suspicious patterns.

Correção

Identificadores relacionados

CVE-2001-1152

Produtos afetados

Websweeper

Referências · 4

• http://securityfocus.com/cgi-bin/vulns-item.pl?section=info&id=3296 · Aviso do Fabricante
• http://mimesweeper.com/support/technotes/notes/1043.asp · Aviso do Fabricante
• http://securityfocus.com/archive/1/212283 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1152 · Nota de Segurança