Lucene search

MitreCVE-2011-1715

HistoryApr 18, 2011 - 6:55 p.m.

CVE-2011-1715

2011-04-1818:55:02

CWE-22

mitre

web.nvd.nist.gov

cve-2011-1715

directory traversal

qooxdoo

eyeos

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.022

Percentile

89.7%

JSON

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via …%2f (encoded dot dot) sequences in the file parameter.

Affected configurations

Nvd

Node

qooxdooqooxdooMatch1.3

AND

eyeoseyeosMatch2.2

eyeoseyeosMatch2.3

VendorProductVersionCPE
qooxdooqooxdoo1.3cpe:2.3:a:qooxdoo:qooxdoo:1.3:*:*:*:*:*:*:*
eyeoseyeos2.2cpe:2.3:o:eyeos:eyeos:2.2:*:*:*:*:*:*:*
eyeoseyeos2.3cpe:2.3:o:eyeos:eyeos:2.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qooxdoo	qooxdoo	1.3	cpe:2.3:a:qooxdoo:qooxdoo:1.3:::::::*
eyeos	eyeos	2.2	cpe:2.3:o:eyeos:eyeos:2.2:::::::*
eyeos	eyeos	2.3	cpe:2.3:o:eyeos:eyeos:2.3:::::::*

References

blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/

osvdb.org/71719

osvdb.org/71721

secunia.com/advisories/43818

secunia.com/advisories/43997

www.autosectools.com/Advisories/eyeOS.2.3_Local.File.Inclusion_173.html

www.exploit-db.com/exploits/17127

www.securityfocus.com/bid/47184

exchange.xforce.ibmcloud.com/vulnerabilities/66574

exchange.xforce.ibmcloud.com/vulnerabilities/66575

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.022

Percentile

89.7%

JSON

Related for CVE-2011-1715