PT-2008-2150 · Unknown · Bubbling Library

Stack-Terrorist · Publicado 2008-01-31 · Atualizado 2017-09-29 · CVE-2008-0521

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bubbling Library version 1.32

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. (dot dot) in the uri parameter to dispatcher.php in various directories, including examples/dispatcher/framework/, examples/dispatcher/, examples/wizard/, and PHP/.

Recommendations For Bubbling Library version 1.32, consider restricting access to the dispatcher.php file in the mentioned directories until a patch is available. As a temporary workaround, avoid using the uri parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0521

Produtos afetados

Bubbling Library

Referências · 4

• 🔥 https://exploit-db.com/exploits/5001 · Exploit
• http://securityfocus.com/bid/27482 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0521 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40008 · Nota