CVE-2004-2478
First published: Fri Dec 31 2004(Updated: )
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Trading Partner Interchange | =4.2.1 | |
| Jetty Jetty Http Server | =4.1.0_rc4 | |
| Jetty Jetty Http Server | =4.2.11 | |
| Jetty Jetty Http Server | =4.2.12 | |
| Jetty Jetty Http Server | =4.2.7 | |
| Jetty Jetty Http Server | =4.2.18 | |
| Jetty Jetty Http Server | =4.2.5 | |
| Jetty Jetty Http Server | =4.2.19 | |
| Jetty Jetty Http Server | =4.2.16 | |
| Jetty Jetty Http Server | =4.1.0 | |
| Jetty Jetty Http Server | =4.2.4 | |
| IBM Trading Partner Interchange | <=4.2.2 | |
| CA Unicenter Web Services Distributed Management | <=3.1 | |
| Jetty Jetty Http Server | =4.2.15 | |
| Jetty Jetty Http Server | =3.1.7 | |
| Jetty Jetty Http Server | =4.2.9 | |
| Jetty Jetty Http Server | =4.2.6 | |
| Jetty Jetty Http Server | =3.1.6 | |
| Jetty Jetty Http Server | =4.2.14 | |
| Jetty Jetty Http Server | =4.1.1 | |
| Jetty Jetty Http Server | =4.2.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-1.ibm.com/support/docview.wss?uid=swg21178665
- http://www.securityfocus.com/bid/11330
- http://www.osvdb.org/10490
- http://securitytracker.com/id?1011545
- http://secunia.com/advisories/12703
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html
- http://securitytracker.com/id?1016975
- http://secunia.com/advisories/22229
- http://www.vupen.com/english/advisories/2006/3873
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17600
- http://www.securityfocus.com/archive/1/447648/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm trading partner interchange
- version/ibm trading partner interchange/4.2.1
- vendor/jetty
- canonical/jetty jetty http server
- version/jetty jetty http server/4.1.0_rc4
- version/jetty jetty http server/4.2.11
- version/jetty jetty http server/4.2.12
- version/jetty jetty http server/4.2.7
- version/jetty jetty http server/4.2.18
- version/jetty jetty http server/4.2.5
- version/jetty jetty http server/4.2.19
- version/jetty jetty http server/4.2.16
- version/jetty jetty http server/4.1.0
- version/jetty jetty http server/4.2.4
- version/ibm trading partner interchange/4.2.2
- vendor/ca
- canonical/ca unicenter web services distributed management
- version/ca unicenter web services distributed management/3.1
- version/jetty jetty http server/4.2.15
- version/jetty jetty http server/3.1.7
- version/jetty jetty http server/4.2.9
- version/jetty jetty http server/4.2.6
- version/jetty jetty http server/3.1.6
- version/jetty jetty http server/4.2.14
- version/jetty jetty http server/4.1.1
- version/jetty jetty http server/4.2.17