Overview
AjaXplorer 4.0.3 and earlier versions contain a directory traversal vulnerability and a weak cookie authentication scheme.
Description
AjaXplorer contains a directory traversal vulnerability in the "Get Template" feature. The URL variables template_name and pluginName can be used to exploit this vulnerability. |
Impact
A remote unauthenticated attacker may be able to read any file on the server that the web service can access. If an attacker can steal a user's cookie or access the password file they can use the password hash to log in as that user without knowing the password. |
Solution
Apply an Update AjaXplorer 4.0.4 has been released to address these vulnerabilities. |
Vendor Information
504019
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 3.8 | AV:N/AC:--/Au:S/C:C/I:P/A:N |
| Temporal | 3 | E:POC/RL:OF/RC:C |
| Environmental | 3 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to StenoPlasma for reporting this vulnerability.
This document was written by Jared Allar.
Other Information
| CVE IDs: | None |
| Severity Metric: | 0.18 |
| Date Public: | 2012-03-02 |
| Date First Published: | 2012-03-08 |
| Date Last Updated: | 2012-03-28 12:31 UTC |
| Document Revision: | 18 |