PT-2008-2113 · Web Wiz · Web Wiz Rich Text Editor

Publicado 2008-01-29 · Atualizado 2018-10-15 · CVE-2008-0481

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz Rich Text Editor version 4.0

Description A directory traversal issue exists in the RTE file browser.asp file, allowing remote attackers to list arbitrary directories and access .txt and .zip files. This is achieved by manipulating the sub parameter in a save action with a sequence of directory traversal characters.

Recommendations For Web Wiz Rich Text Editor version 4.0, consider restricting access to the RTE file browser.asp file until a patch is available, or apply configuration changes to limit the ability to traverse directories via the sub parameter.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0481

Produtos afetados

Web Wiz Rich Text Editor

Referências · 11

• 🔥 http://bugreport.ir/?/31 · Exploit
• 🔥 http://securitytracker.com/id?1019267 · Exploit
• 🔥 https://exploit-db.com/exploits/4971 · Exploit
• http://secunia.com/advisories/28639 · Aviso do Fabricante
• http://securityreason.com/securityalert/3584 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0481 · Nota
• http://securityfocus.com/bid/27419 · Nota
• http://webwizguide.com/webwizrichtexteditor/kb/release_notes.asp · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39868 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0481 · Nota de Segurança
• http://securityfocus.com/archive/1/486868/100/0/threaded · Nota