PT-2004-3370 · Ca+2 · Ca Unicenter Web Services Distributed Management+2

Publicado 2004-12-31 · Atualizado 2018-10-19 · CVE-2004-2478

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jetty HTTP Server versions prior to 4.2.4 IBM Trading Partner Interchange versions prior to 4.2.4 CA Unicenter Web Services Distributed Management (WSDM) versions prior to 3.11

Description: The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. This could potentially lead to unauthorized access to sensitive information.

Recommendations: For Jetty HTTP Server versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. For IBM Trading Partner Interchange versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. For CA Unicenter Web Services Distributed Management (WSDM) versions prior to 3.11, update to version 3.11 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2004-2478

Produtos afetados

Ca Unicenter Web Services Distributed Management

Ibm Trading Partner Interchange

Jetty Http Server

Referências · 12

• http://securityfocus.com/bid/11330 · Nota
• http://secunia.com/advisories/22229 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg21178665 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2478 · Nota de Segurança
• http://secunia.com/advisories/12703 · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html · Nota
• http://securitytracker.com/id?1016975 · Nota
• http://vupen.com/english/advisories/2006/3873 · Aviso do Fabricante
• http://securityfocus.com/archive/1/447648/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17600 · Nota
• http://osvdb.org/10490 · Nota
• http://securitytracker.com/id?1011545 · Nota