CVE-2000-0920

MEDIUM

Description

Directory traversal vulnerability in BOA web server 0.94.8.2 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request that uses a "%2E" instead of a "."

References

ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:60.boa.asc

http://archives.neohapsis.com/archives/bugtraq/2000-10/0092.html

http://www.debian.org/security/2000/20001009

http://www.securityfocus.com/bid/1770

https://exchange.xforce.ibmcloud.com/vulnerabilities/5330

Details

Source: MITRE

Published: 2000-12-19

Updated: 2017-10-10

Risk Information

CVSS v2.0

Base Score: 5

Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM