PT-2009-1394 · Websvn · Websvn

James Bercegay · Publicado 2009-01-21 · Atualizado 2017-09-29 · CVE-2008-5919

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSVN versions 2.0 and earlier

Description A directory traversal issue exists in the rss.php file of WebSVN, allowing remote attackers to overwrite arbitrary files when magic quotes gpc is disabled. This is achieved through directory traversal sequences in the rev parameter.

Recommendations For WebSVN versions 2.0 and earlier, consider disabling the rss.php file or restricting access to it until a fix is available. As a temporary workaround, enable magic quotes gpc to prevent directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5919

Produtos afetados

Websvn

Referências · 12

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00132-10202008 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5919 · Nota de Segurança
• http://secunia.com/advisories/34191 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5919 · Nota
• http://websvn.tigris.org/issues/show_bug.cgi?id=179 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46050 · Nota
• http://gentoo.org/security/en/glsa/glsa-200903-20.xml · Aviso do Fabricante
• http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 · Correção
• http://securityreason.com/securityalert/4928 · Nota
• http://secunia.com/advisories/32338 · Aviso do Fabricante