CVE-2004-2478
First published: Fri Dec 31 2004(Updated: )
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CA Unicenter Web Services Distributed Management | <=3.1 | |
| IBM Trading Partner Interchange | <=4.2.2 | |
| IBM Trading Partner Interchange | =4.2.1 | |
| Mortbay Jetty | =3.1.6 | |
| Mortbay Jetty | =3.1.7 | |
| Mortbay Jetty | =4.1.0 | |
| Mortbay Jetty | =4.1.0_rc4 | |
| Mortbay Jetty | =4.1.1 | |
| Mortbay Jetty | =4.2.4 | |
| Mortbay Jetty | =4.2.5 | |
| Mortbay Jetty | =4.2.6 | |
| Mortbay Jetty | =4.2.7 | |
| Mortbay Jetty | =4.2.9 | |
| Mortbay Jetty | =4.2.11 | |
| Mortbay Jetty | =4.2.12 | |
| Mortbay Jetty | =4.2.14 | |
| Mortbay Jetty | =4.2.15 | |
| Mortbay Jetty | =4.2.16 | |
| Mortbay Jetty | =4.2.17 | |
| Mortbay Jetty | =4.2.18 | |
| Mortbay Jetty | =4.2.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-1.ibm.com/support/docview.wss?uid=swg21178665
- http://www.securityfocus.com/bid/11330
- http://www.osvdb.org/10490
- http://securitytracker.com/id?1011545
- http://secunia.com/advisories/12703
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html
- http://securitytracker.com/id?1016975
- http://secunia.com/advisories/22229
- http://www.vupen.com/english/advisories/2006/3873
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17600
- http://www.securityfocus.com/archive/1/447648/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2004-2478?
CVE-2004-2478 is classified as a high severity vulnerability due to the potential for remote attackers to read arbitrary files on the server.
How do I fix CVE-2004-2478?
To address CVE-2004-2478, upgrade your Jetty HTTP Server and any affected applications to a version that includes the necessary security patches.
Which products are affected by CVE-2004-2478?
CVE-2004-2478 impacts IBM Trading Partner Interchange and CA Unicenter Web Services Distributed Management, among other products that use Jetty.
Can CVE-2004-2478 be exploited remotely?
Yes, CVE-2004-2478 can be exploited remotely, allowing attackers to read sensitive files via specially crafted URLs.
What should I do if I am using a vulnerable version related to CVE-2004-2478?
If you are using a vulnerable version related to CVE-2004-2478, it is critical to update to a secure version immediately to mitigate the risk.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/ca
- canonical/ca unicenter web services distributed management
- version/ca unicenter web services distributed management/3.1
- vendor/ibm
- canonical/ibm trading partner interchange
- version/ibm trading partner interchange/4.2.2
- version/ibm trading partner interchange/4.2.1
- vendor/jetty
- canonical/mortbay jetty
- version/mortbay jetty/3.1.6
- version/mortbay jetty/3.1.7
- version/mortbay jetty/4.1.0
- version/mortbay jetty/4.1.0_rc4
- version/mortbay jetty/4.1.1
- version/mortbay jetty/4.2.4
- version/mortbay jetty/4.2.5
- version/mortbay jetty/4.2.6
- version/mortbay jetty/4.2.7
- version/mortbay jetty/4.2.9
- version/mortbay jetty/4.2.11
- version/mortbay jetty/4.2.12
- version/mortbay jetty/4.2.14
- version/mortbay jetty/4.2.15
- version/mortbay jetty/4.2.16
- version/mortbay jetty/4.2.17
- version/mortbay jetty/4.2.18
- version/mortbay jetty/4.2.19