The remote application server is affected by potential information disclosure related to a remote directory traversal vulnerability. The vendor has released EBF files (patches) for the affected versions.

It appears possible to read arbitrary files on the remote host outside the web server's document directory using a specially crafted URL.  An unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks.

Note that this plugin is not limited to testing for known vulnerabilities in a specific set of web servers. Instead, it attempts a variety of generic directory traversal attacks and considers a product to be vulnerable simply if it finds evidence of the contents of '/etc/passwd' or a Windows 'win.ini' file in the response. It may, in fact, uncover 'new' issues, that have yet to be reported to the product's vendor.

ID	Name	Product	Family	Published	Updated	Severity
6902	EAServer <= 6.3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2013/07/03	2019/03/06	medium
10297	Web Server Directory Traversal Arbitrary File Access	Nessus	Web Servers	1999/11/05	2018/09/17	critical

Plugins Search