6.8

CVE-2008-2519

Exploit
Directory traversal vulnerability in Core FTP client 2.1 Build 1565 allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot) sequences in responses to LIST commands, a related issue to CVE-2002-1345.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Core Ftp ≫ Core Ftp Version2.1 Updatebuild_1565 Editionle
Core Ftp ≫ Core Ftp Version2.1 Updatebuild_1565 Editionpro
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.35% 0.815
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://secunia.com/advisories/30389
Vendor Advisory
http://vuln.sg/coreftp211565-en.html
Exploit
http://www.coreftp.com/forums/viewtopic.php?t=6078
Patch
http://www.securityfocus.com/bid/29362
http://www.vupen.com/english/advisories/2008/1643/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42605