PT-2006-2937 · Caucho · Caucho Resin

Publicado 2006-05-17 · Atualizado 2018-10-18 · CVE-2006-1953

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Caucho Resin versions 3.0.17 through 3.0.18

Description A directory traversal issue allows remote attackers to read arbitrary files. This is achieved by using a "C:%5C" (encoded drive letter) in a URL.

Recommendations For versions 3.0.17 and 3.0.18, consider restricting access to sensitive files and directories until a patch is available. As a temporary workaround, avoid using encoded drive letters in URLs to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1953

Produtos afetados

Caucho Resin

Referências · 12

• http://securityreason.com/securityalert/904 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1953 · Nota
• http://rapid7.com/advisories/R7-0024.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26478 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0026.html · Nota
• http://securityfocus.com/archive/1/434150/100/0/threaded · Nota
• http://secunia.com/advisories/20125 · Nota
• http://osvdb.org/25570 · Nota
• http://vupen.com/english/advisories/2006/1831 · Nota
• http://securitytracker.com/id?1016109 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1953 · Nota de Segurança
• http://securityfocus.com/bid/18005 · Correção