Detections
Analytics
CGI Generic Path Traversal (quick test)
medium Nessus Plugin ID 50494
Language:
Synopsis
Arbitrary files may be accessed or executed on the remote host.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local files inclusion vulnerabilities.By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands.
Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.See Also
https://en.wikipedia.org/wiki/Directory_traversal
http://projects.webappsec.org/w/page/13246952/Path%20Traversal
http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection
Plugin Details
Severity: Medium
ID: 50494
File Name: torture_cgi_quick_dir_trav.nasl
Version: 1.19
Type: remote
Family: CGI abuses
Published: 11/5/2010
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests