CVE-2009-3787 - files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two

Back Back to CVE browser

MEDIUM

files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two

Published Oct 26, 2009

5.0

MEDIUM

CVSS 2.0

EPSS 6.58%

Description

files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

http://secunia.com/advisories/37117
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/507358/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/36783
vdb-entryx_refsource_BIDExploit
http://www.waraxe.us/advisory-75.html
x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3759
Advisory

Link	Providers	Tags
http://secunia.com/advisories/37117		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/507358/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/36783		vdb-entryx_refsource_BIDExploit
http://www.waraxe.us/advisory-75.html		x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3759		Advisory