PT-2004-1456 · Owls · Owls

G00Db0Y · Publicado 2004-03-18 · Atualizado 2017-07-11 · CVE-2004-0302

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OWLS version 1.0

Description A directory traversal issue allows remote attackers to read arbitrary files by using a .. (dot dot) in specific parameters. This can be achieved through the file parameter in "index.php", the editfile parameter in "glossary.php", or the editfile parameter in "newmultiplechoice.php".

Recommendations For OWLS version 1.0, consider restricting access to the file, editfile parameters in the affected API endpoints until a patch is available. As a temporary workaround, avoid using the file parameter in "index.php" and the editfile parameter in "glossary.php" and "newmultiplechoice.php" to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-0302

Produtos afetados

Owls

Referências · 8

• 🔥 https://exploit-db.com/exploits/23724 · Exploit
• 🔥 http://securityfocus.com/bid/9689 · Exploit
• 🔥 https://exploit-db.com/exploits/23723 · Exploit
• 🔥 https://exploit-db.com/exploits/23722 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0302 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=107712123305706&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15249 · Nota
• http://zone-h.org/en/advisories/read/id=3973 · Nota