PT-2008-2111 · Web Wiz · Web Wiz Newspad

Publicado 2008-01-29 · Atualizado 2018-10-15 · CVE-2008-0479

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz NewsPad version 1.02

Description A directory traversal issue exists, allowing remote attackers to list arbitrary directories and access certain file types, such as .txt and .zip files, by manipulating the sub parameter in the RTE file browser.asp file.

Recommendations For Web Wiz NewsPad version 1.02, consider restricting access to the RTE file browser.asp file until a patch is available, and avoid using the sub parameter in this file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0479

Produtos afetados

Web Wiz Newspad

Referências · 10

• 🔥 https://exploit-db.com/exploits/4972 · Exploit
• 🔥 http://securitytracker.com/id?1019268 · Exploit
• 🔥 http://bugreport.ir/?/30 · Exploit
• http://securityfocus.com/archive/1/486869/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39863 · Nota
• http://securityreason.com/securityalert/3588 · Nota
• http://webwizguide.com/webwiznewspad/kb/release_notes.asp · Nota
• http://securityfocus.com/bid/27419 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0479 · Nota de Segurança
• http://secunia.com/advisories/28416 · Aviso do Fabricante