CVE-2006-5981

Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET (RETR), and (3) PUT (STOR) commands.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/22928	Vendor Advisory
http://whitestar.linuxbox.org/pipermail/exploits/2006-November/000037.html
http://www.osvdb.org/30448
http://www.vupen.com/english/advisories/2006/4540	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30332

Configurations

Configuration 1 (hide)

cpe:2.3:a:biba_software:seleniumserver_ftp_server:1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-11-20 21:07

Updated : 2023-12-10 10:40

NVD link : CVE-2006-5981

Mitre link : CVE-2006-5981

CVE.ORG link : CVE-2006-5981

JSON object : View

Products Affected

biba_software

seleniumserver_ftp_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2006-5981", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-11-20T21:07:00.000", "references": [{"url": "http://secunia.com/advisories/22928", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://whitestar.linuxbox.org/pipermail/exploits/2006-November/000037.html", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/30448", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4540", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30332", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET (RETR), and (3) PUT (STOR) commands."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en Selenium Server 1.0, y posiblemente anteriores, permiten a atacantes remotos listar directorios de su elecci\u00f3n, leer archivos de su elecci\u00f3n, y enviar archivos de su elecci\u00f3n mediante secuencias de salto de directorio en los comandos (1) DIR (LIST o NLST), (2) GET (RETR), y (3) PUT (STOR)."}], "lastModified": "2017-07-20T01:34:07.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:biba_software:seleniumserver_ftp_server:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E79A0B4-2C29-4AF1-902E-B431F1E10348"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}