PT-2008-2098 · Web Wiz · Web Wiz Newspad+2

Publicado 2008-01-28 · Atualizado 2018-10-15 · CVE-2008-0466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz Rich Text Editor version 4.0 Web Wiz Forums version 9.07 Web Wiz Newspad version 1.02

Description The issue allows remote attackers to list directories and read files without requiring authentication. This can be further exploited to access files outside the configured directory tree by leveraging a separate directory traversal issue.

Recommendations For Web Wiz Rich Text Editor version 4.0, update the RTE file browser.asp to require authentication. For Web Wiz Forums version 9.07, restrict access to the RTE file browser.asp file to authenticated users. For Web Wiz Newspad version 1.02, consider disabling the RTE file browser.asp file until a patch is available that enforces authentication.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-0466

Produtos afetados

Web Wiz Forums

Web Wiz Newspad

Web Wiz Rich Text Editor

Referências · 12

• 🔥 https://exploit-db.com/exploits/4970 · Exploit
• 🔥 https://exploit-db.com/exploits/4971 · Exploit
• http://securitytracker.com/id?1019267 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0466 · Nota
• http://bugreport.ir/?/29 · Nota
• http://securityfocus.com/archive/1/486866/100/0/threaded · Nota
• http://securityreason.com/securityalert/3584 · Nota
• http://securityfocus.com/bid/27419 · Nota
• http://webwizguide.com/webwizrichtexteditor/kb/release_notes.asp · Nota
• http://securityfocus.com/archive/1/486868/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0466 · Nota de Segurança
• http://bugreport.ir/?/31 · Nota