PT-2006-7116 · Nullsoft · Winamp Web Interface

Luigi Auriemma · Publicado 2006-12-14 · Atualizado 2018-10-17 · CVE-2006-6512

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Winamp Web Interface (Wawi) versions 7.5.13 and earlier

Description The issue allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter of the "/browse URI" API endpoint. This is due to a directory traversal vulnerability in the Browse function.

Recommendations For Winamp Web Interface (Wawi) versions 7.5.13 and earlier, as a temporary workaround, consider restricting access to the "/browse URI" API endpoint until a patch is available. Avoid using URL encoded backslashes ("%2F") in the path parameter to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-6512

Produtos afetados

Winamp Web Interface

Referências · 10

• http://securitytracker.com/id?1017362 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6512 · Nota de Segurança
• http://securityreason.com/securityalert/2032 · Nota
• http://secunia.com/advisories/23292 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30827 · Nota
• http://aluigi.altervista.org/adv/wawix-adv.txt · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6512 · Nota
• http://securityfocus.com/archive/1/454059/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/4935 · Nota