PT-2009-1992 · Software Ag · Terracotta

Publicado 2009-03-25 · Atualizado 2018-10-11 · CVE-2008-6522

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Terracotta (aka OpenTerracotta) versions 0.6.1 and possibly other versions

Description The issue concerns directory traversal vulnerabilities in the RenderFile function within ContentRender.class.php. This allows remote attackers to list arbitrary directories and read arbitrary files by utilizing a .. (dot dot) in the CurrentDirectory and File parameters to the "index.php" endpoint.

Recommendations For Terracotta (aka OpenTerracotta) version 0.6.1, consider restricting access to the RenderFile function in ContentRender.class.php until a patch is available. As a temporary workaround, avoid using the CurrentDirectory and File parameters in the index.php endpoint to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6522

Produtos afetados

Terracotta

Referências · 5

• 🔥 http://securityfocus.com/bid/28550 · Exploit
• 🔥 https://exploit-db.com/exploits/31584 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6522 · Nota de Segurança
• http://securityfocus.com/archive/1/490341/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41572 · Nota