SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#471075

4D WebServer does not adequately validate user input thereby allowing directory traversal

Overview

4D WebServer does not properly validate HTTP requests, allowing directory traversal outside the root web directory.

I. Description

4D WebServer versions 6.5.7 and earlier do not properly validate HTTP requests, allowing directory traversal outside the root web directory.

II. Impact

Remote attackers can view any file on the filesystem with privileges of the web server.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Systems Affected
VendorStatusDate Updated
4DVulnerable23-Sep-2002

References


http://www.securityfocus.com/bid/3209
http://www.4d.com/

Credit

Thanks to KF for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public08/20/2001
Date First Published09/26/2002 05:54:42 PM
Date Last Updated09/26/2002
CERT Advisory 
CVE Name 
US-CERT Technical Alerts 
Metric2.81
Document Revision4

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2002 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader