PT-2002-2088 · Ez · Ezcontents

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-1083

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ezContents versions 1.41 and earlier

Description: The issue allows remote attackers to cause ezContents to create directories or list directories via .. (dot dot) sequences. This can be achieved through the Maintain Images:Add New:Create Subdirectory item or the Maintain Images file listing.

Recommendations: For ezContents versions 1.41 and earlier, consider restricting access to the Maintain Images feature until a fix is available. As a temporary workaround, avoid using the .. (dot dot) sequences in the Maintain Images file listing and the Create Subdirectory item to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2002-1083

Affected Products

Ezcontents

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1083 · Security Note
• http://iss.net/security_center/static/9710.php · Vendor Advisory
• http://online.securityfocus.com/archive/1/284229 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html · Note