PT-2004-3370 · Ca+2 · Ca Unicenter Web Services Distributed Management+2

Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-2478

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jetty HTTP Server versions prior to 4.2.4 IBM Trading Partner Interchange versions prior to 4.2.4 CA Unicenter Web Services Distributed Management (WSDM) versions prior to 3.11

Description: The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. This could potentially lead to unauthorized access to sensitive information.

Recommendations: For Jetty HTTP Server versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. For IBM Trading Partner Interchange versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. For CA Unicenter Web Services Distributed Management (WSDM) versions prior to 3.11, update to version 3.11 or later to resolve the issue.

Fix

Related Identifiers

CVE-2004-2478

Affected Products

Ca Unicenter Web Services Distributed Management

Ibm Trading Partner Interchange

Jetty Http Server

References · 12

• http://secunia.com/advisories/22229 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg21178665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2478 · Security Note
• http://secunia.com/advisories/12703 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3873 · Vendor Advisory
• http://securityfocus.com/bid/11330 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html · Note
• http://securitytracker.com/id?1016975 · Note
• http://securityfocus.com/archive/1/447648/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17600 · Note
• http://osvdb.org/10490 · Note
• http://securitytracker.com/id?1011545 · Note