CVE-2000-0811: Medium severity CGI Script Center Auction Weaver vulnerability

Published Dec 19, 2000

Updated

Auction Weaver 1.0 through 1.04 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the username or bidfile form fields.

Affected Software

5 affected components

CGI Script Center Auction Weaver=1.0

CGI Script Center Auction Weaver=1.03

CGI Script Center Auction Weaver=1.01

CGI Script Center Auction Weaver=1.04

CGI Script Center Auction Weaver=1.02

Event History

Dec 19, 2000

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Jan 22, 2001

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

CGI Script Center Auction Weaver versions 1.0 through 1.04 are identified as affected. The issue is remotely exploitable and requires no authentication.

What input fields can an attacker use to access files?

The username and bidfile form fields are identified as attack vectors. An attacker can use dot-dot path traversal sequences in those fields to attempt to read arbitrary files.

What is the impact of successful exploitation?

Successful exploitation can disclose arbitrary files readable by the affected Auction Weaver CGI process. The provided data identifies confidentiality impact only; it does not identify integrity or availability impact.

CVE-2000-0811: Medium severity CGI Script Center Auction Weaver vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What input fields can an attacker use to access files?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What input fields can an attacker use to access files?

What is the impact of successful exploitation?