search menu icon-carat-right cmu-wordmark

CERT Coordination Center

AjaXplorer contains multiple vulnerabilities

Vulnerability Note VU#504019

Original Release Date: 2012-03-08 | Last Revised: 2012-03-28


AjaXplorer 4.0.3 and earlier versions contain a directory traversal vulnerability and a weak cookie authentication scheme.


AjaXplorer contains a directory traversal vulnerability in the "Get Template" feature. The URL variables template_name and pluginName can be used to exploit this vulnerability.


A remote unauthenticated attacker may be able to read any file on the server that the web service can access. If an attacker can steal a user's cookie or access the password file they can use the password hash to log in as that user without knowing the password.


Apply an Update

AjaXplorer 4.0.4 has been released to address these vulnerabilities.

Vendor Information


AjaXplorer Affected

Notified:  February 27, 2012 Updated: March 05, 2012



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group Score Vector
Base 3.8 AV:N/AC:--/Au:S/C:C/I:P/A:N
Temporal 3 E:POC/RL:OF/RC:C
Environmental 3 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND



Thanks to StenoPlasma for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs: None
Severity Metric: 0.18
Date Public: 2012-03-02
Date First Published: 2012-03-08
Date Last Updated: 2012-03-28 12:31 UTC
Document Revision: 18

Sponsored by CISA.