7.5

CVE-2004-0204

Exploit
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bea ≫ Weblogic Server Version 8.1
Bea ≫ Weblogic Server Version 8.1 Edition express
Bea ≫ Weblogic Server Version 8.1 Edition win32
Bea ≫ Weblogic Server Version 8.1 Update sp1
Bea ≫ Weblogic Server Version 8.1 Update sp1 Edition express
Bea ≫ Weblogic Server Version 8.1 Update sp1 Edition win32
Bea ≫ Weblogic Server Version 8.1 Update sp2
Bea ≫ Weblogic Server Version 8.1 Update sp2 Edition express
Bea ≫ Weblogic Server Version 8.1 Update sp2 Edition win32
Businessobjects ≫ Crystal Enterprise Ras Version 8.5 Edition unix
Microsoft ≫ Outlook Version 2003 Edition business_contact_manager
Microsoft ≫ Visual Studio .Net Version 2003 Update gold
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 72.99% 0.994
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://marc.info/?l=bugtraq&m=108360413811017&w=2
http://marc.info/?l=bugtraq&m=108671836127360&w=2
http://secunia.com/advisories/11800
http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp
http://www.osvdb.org/6748
http://www.securityfocus.com/bid/10260
Patch
Vendor Advisory
Exploit
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017
https://exchange.xforce.ibmcloud.com/vulnerabilities/16044
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157