PT-2010-5037 · Visual Synapse · Visual Synapse Http Server

Felipe Aragon · Publicado 2010-10-08 · Atualizado 2018-10-10 · CVE-2010-3743

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visual Synapse HTTP Server versions 0.60 and earlier, 1.0 RC1 through RC3

Description A directory traversal issue allows remote attackers to read arbitrary files by including a .. (dot dot) in the URI. This could potentially expose sensitive information.

Recommendations For versions 0.60 and earlier, and 1.0 RC1 through RC3, consider restricting access to sensitive files and directories until a patch is available. As a temporary workaround, consider disabling the ability to access files using the .. (dot dot) notation in the URI until a fix is released.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-3743

Produtos afetados

Visual Synapse Http Server

Referências · 5

• 🔥 http://exploit-db.com/exploits/15216 · Exploit
• 🔥 http://securityfocus.com/bid/43830 · Exploit
• http://securityfocus.com/archive/1/514167/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3743 · Nota de Segurança
• http://syhunt.com/advisories/?id=vs-httpd-dirtrav · Nota