PT-2008-2113 · Web Wiz · Web Wiz Rich Text Editor

Published 2008-01-29 · Updated 2018-10-15 · CVE-2008-0481

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Wiz Rich Text Editor version 4.0

Description A directory traversal issue exists in the RTE file browser.asp file, allowing remote attackers to list arbitrary directories and access .txt and .zip files. This is achieved by manipulating the sub parameter in a save action with a sequence of directory traversal characters.

Recommendations For Web Wiz Rich Text Editor version 4.0, consider restricting access to the RTE file browser.asp file until a patch is available, or apply configuration changes to limit the ability to traverse directories via the sub parameter.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0481

Affected Products

Web Wiz Rich Text Editor

References · 11

• 🔥 http://bugreport.ir/?/31 · Exploit
• 🔥 http://securitytracker.com/id?1019267 · Exploit
• 🔥 https://exploit-db.com/exploits/4971 · Exploit
• http://secunia.com/advisories/28639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0481 · Security Note
• http://securityreason.com/securityalert/3584 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0481 · Note
• http://securityfocus.com/bid/27419 · Note
• http://webwizguide.com/webwizrichtexteditor/kb/release_notes.asp · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39868 · Note
• http://securityfocus.com/archive/1/486868/100/0/threaded · Note