PT-2008-2098 · Web Wiz · Web Wiz Newspad+2

Published 2008-01-28 · Updated 2018-10-15 · CVE-2008-0466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz Rich Text Editor version 4.0 Web Wiz Forums version 9.07 Web Wiz Newspad version 1.02

Description The issue allows remote attackers to list directories and read files without requiring authentication. This can be further exploited to access files outside the configured directory tree by leveraging a separate directory traversal issue.

Recommendations For Web Wiz Rich Text Editor version 4.0, update the RTE file browser.asp to require authentication. For Web Wiz Forums version 9.07, restrict access to the RTE file browser.asp file to authenticated users. For Web Wiz Newspad version 1.02, consider disabling the RTE file browser.asp file until a patch is available that enforces authentication.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-0466

Affected Products

Web Wiz Forums

Web Wiz Newspad

Web Wiz Rich Text Editor

References · 12

• 🔥 https://exploit-db.com/exploits/4970 · Exploit
• 🔥 https://exploit-db.com/exploits/4971 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0466 · Security Note
• http://securitytracker.com/id?1019267 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0466 · Note
• http://bugreport.ir/?/29 · Note
• http://securityfocus.com/archive/1/486866/100/0/threaded · Note
• http://securityreason.com/securityalert/3584 · Note
• http://securityfocus.com/bid/27419 · Note
• http://webwizguide.com/webwizrichtexteditor/kb/release_notes.asp · Note
• http://securityfocus.com/archive/1/486868/100/0/threaded · Note
• http://bugreport.ir/?/31 · Note