Overview
4D WebServer does not properly validate HTTP requests, allowing directory traversal outside the root web directory.
Description
4D WebServer versions 6.5.7 and earlier do not properly validate HTTP requests, allowing directory traversal outside the root web directory. |
Impact
Remote attackers can view any file on the filesystem with privileges of the web server. |
Solution
The CERT/CC is currently unaware of a practical solution to this problem. |
Vendor Information
471075
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to KF for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | CVE-2001-0971 |
| Severity Metric: | 2.81 |
| Date Public: | 2001-08-20 |
| Date First Published: | 2002-09-26 |
| Date Last Updated: | 2002-09-26 21:54 UTC |
| Document Revision: | 4 |