Detections
Analytics
CGI Generic Path Traversal
medium Nessus Plugin ID 39467
Language:
Synopsis
Arbitrary files may be accessed or executed on the remote host.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local files inclusion vulnerabilities.By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands.
Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade to address path traversal flaws.See Also
https://en.wikipedia.org/wiki/Directory_traversal
http://cwe.mitre.org/data/definitions/22.html
http://projects.webappsec.org/w/page/13246952/Path%20Traversal
http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection
Plugin Details
Severity: Medium
ID: 39467
File Name: torture_cgi_directory_traversal.nasl
Version: 1.34
Type: remote
Family: CGI abuses
Published: 6/19/2009
Updated: 4/7/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests