PT-2006-1629 · Xaraya · Xaraya

Published 2006-02-07 · Updated 2017-07-20 · CVE-2006-0567

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Files Xaraya module versions prior to 0.5.1

Description The issue allows remote attackers to access files outside of the web root via ".." (dot dot) sequences when the Archive Directory field on the Modify Config page is blank. This is due to a directory traversal vulnerability.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider setting a valid Archive Directory path on the Modify Config page to prevent exploitation.

Fix

Related Identifiers

CVE-2006-0567

Affected Products

Xaraya

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-0567 · Security Note
• http://xaraya.curtisfarnham.com/articles/Files_0.5.1_-_Security_Fix_and_other_things · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24393 · Note
• http://vupen.com/english/advisories/2006/0371 · Note