PT-2006-1629 · Xaraya · Xaraya

Publicado 2006-02-07 · Atualizado 2017-07-20 · CVE-2006-0567

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Files Xaraya module versions prior to 0.5.1

Description The issue allows remote attackers to access files outside of the web root via ".." (dot dot) sequences when the Archive Directory field on the Modify Config page is blank. This is due to a directory traversal vulnerability.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider setting a valid Archive Directory path on the Modify Config page to prevent exploitation.

Correção

Identificadores relacionados

CVE-2006-0567

Produtos afetados

Xaraya

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/24393 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0567 · Nota de Segurança
• http://xaraya.curtisfarnham.com/articles/Files_0.5.1_-_Security_Fix_and_other_things · Correção
• http://vupen.com/english/advisories/2006/0371 · Nota