PT-2008-2111 · Web Wiz · Web Wiz Newspad

Published 2008-01-29 · Updated 2018-10-15 · CVE-2008-0479

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz NewsPad version 1.02

Description A directory traversal issue exists, allowing remote attackers to list arbitrary directories and access certain file types, such as .txt and .zip files, by manipulating the sub parameter in the RTE file browser.asp file.

Recommendations For Web Wiz NewsPad version 1.02, consider restricting access to the RTE file browser.asp file until a patch is available, and avoid using the sub parameter in this file to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0479

Affected Products

Web Wiz Newspad

References · 10

• 🔥 https://exploit-db.com/exploits/4972 · Exploit
• 🔥 http://securitytracker.com/id?1019268 · Exploit
• 🔥 http://bugreport.ir/?/30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0479 · Security Note
• http://secunia.com/advisories/28416 · Vendor Advisory
• http://securityfocus.com/archive/1/486869/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39863 · Note
• http://securityreason.com/securityalert/3588 · Note
• http://webwizguide.com/webwiznewspad/kb/release_notes.asp · Note
• http://securityfocus.com/bid/27419 · Note