PT-2008-2150 · Unknown · Bubbling Library

Stack-Terrorist · Published 2008-01-31 · Updated 2017-09-29 · CVE-2008-0521

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bubbling Library version 1.32

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. (dot dot) in the uri parameter to dispatcher.php in various directories, including examples/dispatcher/framework/, examples/dispatcher/, examples/wizard/, and PHP/.

Recommendations For Bubbling Library version 1.32, consider restricting access to the dispatcher.php file in the mentioned directories until a patch is available. As a temporary workaround, avoid using the uri parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0521

Affected Products

Bubbling Library

References · 4

• 🔥 https://exploit-db.com/exploits/5001 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0521 · Security Note
• http://securityfocus.com/bid/27482 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40008 · Note