PT-2002-1267 · Cwpapi · Cwpapi

Published 2002-05-16 · Updated 2008-09-11 · CVE-2002-0196

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CwpAPI version 1.1

Description The issue allows remote attackers to read or write files outside of the web root, in other directories whose path includes the web root, due to inadequate path verification by the GetRelativePath function.

Recommendations For version 1.1, consider implementing proper path validation to prevent access to files outside the intended web root directory. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0196

Affected Products

Cwpapi

References · 5

• http://iss.net/security_center/static/7981.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0196 · Security Note
• http://sourceforge.net/forum/forum.php?forum_id=144966 · Patch
• http://online.securityfocus.com/archive/1/251699 · Note
• http://securityfocus.com/bid/3924 · Note