CVE-2008-0405
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
84.1%
Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a โฆ (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a โฆ (dot dot) in an account name, when requesting a URI composed of a โ/?%0aโ sequence followed by the data.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| hfs | http_file_server | * | cpe:2.3:a:hfs:http_file_server:*:*:*:*:*:*:*:* |
References
secunia.com/advisories/28631
securityreason.com/securityalert/3581
www.rejetto.com/hfs/?f=wn
www.securityfocus.com/archive/1/486873/100/0/threaded
www.securityfocus.com/bid/27423
www.syhunt.com/advisories/hfs-1-log.txt
www.syhunt.com/advisories/hfshack.txt
exchange.xforce.ibmcloud.com/vulnerabilities/39873
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
84.1%