CVE-2000-0810: High severity CGI Script Center Auction Weaver vulnerability

Published Dec 19, 2000

Updated

Auction Weaver 1.0 through 1.04 does not properly validate the names of form fields, which allows remote attackers to delete arbitrary files and directories via a .. (dot dot) attack.

Affected Software

5 affected components

CGI Script Center Auction Weaver=1.0

CGI Script Center Auction Weaver=1.03

CGI Script Center Auction Weaver=1.01

CGI Script Center Auction Weaver=1.04

CGI Script Center Auction Weaver=1.02

Event History

Dec 19, 2000

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Jan 22, 2001

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can exploit it without authentication. The CVSS vector indicates network access, low attack complexity, and no required authentication.

What access could an attacker gain through successful exploitation?

An attacker can delete arbitrary files and directories by using directory-traversal sequences such as ".." in form-field names. This can affect confidentiality, integrity, and availability according to the listed CVSS impacts.

Which releases are identified as affected?

Auction Weaver versions 1.0 through 1.04 are identified as affected.

CVE-2000-0810: High severity CGI Script Center Auction Weaver vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain through successful exploitation?

Which releases are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain through successful exploitation?

Which releases are identified as affected?