7.5

CVE-2011-0751

Exploit
Directory traversal vulnerability in nhttpd (aka Nostromo webserver) before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f (encoded dot dot slash) in a URI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nazgul ≫ Nostromo Version <= 1.9.3
Nazgul ≫ Nostromo Version 0.1
Nazgul ≫ Nostromo Version 0.2
Nazgul ≫ Nostromo Version 0.3
Nazgul ≫ Nostromo Version 0.4
Nazgul ≫ Nostromo Version 0.5
Nazgul ≫ Nostromo Version 0.6
Nazgul ≫ Nostromo Version 0.7
Nazgul ≫ Nostromo Version 0.8
Nazgul ≫ Nostromo Version 0.9
Nazgul ≫ Nostromo Version 1.0
Nazgul ≫ Nostromo Version 1.1
Nazgul ≫ Nostromo Version 1.2
Nazgul ≫ Nostromo Version 1.3
Nazgul ≫ Nostromo Version 1.4
Nazgul ≫ Nostromo Version 1.5
Nazgul ≫ Nostromo Version 1.5.1
Nazgul ≫ Nostromo Version 1.6
Nazgul ≫ Nostromo Version 1.7
Nazgul ≫ Nostromo Version 1.7.1
Nazgul ≫ Nostromo Version 1.7.2
Nazgul ≫ Nostromo Version 1.7.3
Nazgul ≫ Nostromo Version 1.7.4
Nazgul ≫ Nostromo Version 1.7.5
Nazgul ≫ Nostromo Version 1.7.6
Nazgul ≫ Nostromo Version 1.7.7
Nazgul ≫ Nostromo Version 1.7.8
Nazgul ≫ Nostromo Version 1.7.9
Nazgul ≫ Nostromo Version 1.8
Nazgul ≫ Nostromo Version 1.8.1
Nazgul ≫ Nostromo Version 1.8.2
Nazgul ≫ Nostromo Version 1.8.3
Nazgul ≫ Nostromo Version 1.8.4
Nazgul ≫ Nostromo Version 1.8.5
Nazgul ≫ Nostromo Version 1.8.6
Nazgul ≫ Nostromo Version 1.8.7
Nazgul ≫ Nostromo Version 1.8.8
Nazgul ≫ Nostromo Version 1.8.9
Nazgul ≫ Nostromo Version 1.9
Nazgul ≫ Nostromo Version 1.9.1
Nazgul ≫ Nostromo Version 1.9.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.66% 0.882
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://osvdb.org/71235
http://secunia.com/advisories/43775
http://securityreason.com/securityalert/8140
http://www.nazgul.ch/dev_nostromo.html
http://www.redteam-pentesting.de/advisories/rt-sa-2011-001
Exploit
http://www.securityfocus.com/archive/1/517026/100/0/threaded
http://www.securityfocus.com/bid/46880
http://www.vupen.com/english/advisories/2011/0674
https://exchange.xforce.ibmcloud.com/vulnerabilities/66103