PT-2004-2404 · Unknown · Web Forums Server
Published
2004-12-31
·
Updated
2016-10-18
·
CVE-2004-1496
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Web Forums Server versions 1.6 through 2.0
Description
The issue allows remote attackers to read arbitrary files via a URL containing specific directory traversal sequences, including ".." (dot dot backslash), "../" (dot dot slash), "/%2E%2E%5C" (encoded dot dot backslash), or "%2E%2E%2F" (encoded dot dot slash).
Recommendations
For versions 1.6 through 2.0, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available. Avoid using URLs that contain directory traversal sequences in the affected Web Forums Server.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Web Forums Server