Detections
Analytics
Resin viewfile Servlet Arbitrary File Disclosure
medium Nessus Plugin ID 21607
Language:
Synopsis
The remote web server is prone to arbitrary file access.Description
The remote host is running Resin, an application server.The installation of Resin on the remote host includes a servlet, named 'viewfile', that lets an unauthenticated, remote attacker view any file within the web root directory on the affected host. This could lead to a loss of confidentiality.
Solution
Either remove the 'resin-doc.war' file and do not deploy using default configuration files or upgrade to Resin 3.0.19 or later.See Also
https://www.securityfocus.com/archive/1/434145/30/0/threaded
Plugin Details
Severity: Medium
ID: 21607
File Name: resin_viewfile_file_access.nasl
Version: 1.23
Type: remote
Family: CGI abuses
Published: 5/27/2006
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:caucho:resin
Required KB Items: www/resin
Exploit Ease: No exploit is required
Vulnerability Publication Date: 5/17/2006
Reference Information
CVE: CVE-2006-2437, CVE-2006-2438
BID: 18007