CGI Generic Path Traversal (write test)

medium Nessus Plugin ID 46194

Language:

Synopsis

Arbitrary files may be modified on the remote host.

Description

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities.

By leveraging this issue, an attacker may be able to modify arbitrary files on the web server or execute commands.

Due to the way this flaw is tested, this script is prone to false positives.

Solution

Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.

Plugin Details

Severity: Medium

ID: 46194

File Name: torture_cgi_dir_trav_W.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 4/30/2010

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

Vulnerability Information

Required KB Items: Settings/enable_web_app_tests

Reference Information

OWASP: OWASP-AZ-001

Detections

Analytics