Vulnerability Note VU#471075

4D WebServer does not adequately validate user input thereby allowing directory traversal

4D WebServer does not properly validate HTTP requests, allowing directory traversal outside the root web directory.

4D WebServer versions 6.5.7 and earlier do not properly validate HTTP requests, allowing directory traversal outside the root web directory.

Remote attackers can view any file on the filesystem with privileges of the web server.

The CERT/CC is currently unaware of a practical solution to this problem.

Vendor	Status	Date Notified	Date Updated
4D	Vulnerable	23-Sep-2002

Thanks to KF for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

If you have feedback, comments, or additional information about this vulnerability, please send us email.