PT-2006-1300 · Shanghai Topcmm · Shanghai Topcmm 123 Flash Chat Server

Publicado 2006-01-16 · Atualizado 2017-07-20 · CVE-2006-0223

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shanghai TopCMM 123 Flash Chat Server Software version 5.1

Description The issue allows attackers to create or overwrite arbitrary files on the server by utilizing ".." (dot dot) sequences in the username field, which is a directory traversal vulnerability.

Recommendations For Shanghai TopCMM 123 Flash Chat Server Software version 5.1, consider restricting the use of the username field to prevent directory traversal attacks until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2006-0223

Produtos afetados

Shanghai Topcmm 123 Flash Chat Server

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-0223 · Nota de Segurança
• http://secunia.com/advisories/18455 · Aviso do Fabricante
• http://securityfocus.com/bid/16235 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24137 · Nota
• http://vupen.com/english/advisories/2006/0198 · Aviso do Fabricante
• http://123flashchat.com/flash-chat-server-v512.html · Correção
• http://osvdb.org/22440 · Nota