CVE-2009-5067

2012-10-1018:55:01

CWE-22

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.009

Percentile

82.9%

JSON

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a … (dot dot) in the “include file” SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.

Affected configurations

Nvd

Node

html2ps_projecthtml2psRange≤1.0b5

html2ps_projecthtml2psMatch1.0b1

html2ps_projecthtml2psMatch1.0b2

html2ps_projecthtml2psMatch1.0b3

html2ps_projecthtml2psMatch1.0b4

VendorProductVersionCPE
html2ps_projecthtml2ps*cpe:2.3:a:html2ps_project:html2ps:*:b5:*:*:*:*:*:*
html2ps_projecthtml2ps1.0cpe:2.3:a:html2ps_project:html2ps:1.0:b1:*:*:*:*:*:*
html2ps_projecthtml2ps1.0cpe:2.3:a:html2ps_project:html2ps:1.0:b2:*:*:*:*:*:*
html2ps_projecthtml2ps1.0cpe:2.3:a:html2ps_project:html2ps:1.0:b3:*:*:*:*:*:*
html2ps_projecthtml2ps1.0cpe:2.3:a:html2ps_project:html2ps:1.0:b4:*:*:*:*:*:*

Vendor	Product	Version	CPE
html2ps_project	html2ps	*	cpe:2.3:a:html2ps_project:html2ps::b5::::::*
html2ps_project	html2ps	1.0	cpe:2.3:a:html2ps_project:html2ps:1.0:b1::::::
html2ps_project	html2ps	1.0	cpe:2.3:a:html2ps_project:html2ps:1.0:b2::::::
html2ps_project	html2ps	1.0	cpe:2.3:a:html2ps_project:html2ps:1.0:b3::::::
html2ps_project	html2ps	1.0	cpe:2.3:a:html2ps_project:html2ps:1.0:b4::::::