Vulnerability CVE-2007-2836
Published: 2007-07-02   Modified: 2012-02-12

Description:
Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.

Type:

CWE-22

 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
HIKI -> HIKI 

 References:
http://secunia.com/advisories/25874
http://secunia.com/advisories/25764
http://xforce.iss.net/xforce/xfdb/35029
http://www.vupen.com/english/advisories/2007/2304
http://www.securityfocus.com/bid/24603
http://www.debian.org/security/2007/dsa-1324
http://osvdb.org/37469
http://jvn.jp/jp/JVN%2305187780/index.html
http://hikiwiki.org/hiki-0_8_6.patch
http://hikiwiki.org/en/advisory20070624.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=430691
Copyright 2024, cxsecurity.com

 

Back to Top