CVE-2008-0405

Description

Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name, when requesting a URI composed of a "/?%0a" sequence followed by the data.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/39873

http://www.syhunt.com/advisories/hfs-1-log.txt

http://www.securityfocus.com/bid/27423

http://www.securityfocus.com/archive/1/486873/100/0/threaded

http://securityreason.com/securityalert/3581

http://secunia.com/advisories/28631

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS