CVE-2008-4437: Path Traversal

Published Oct 3, 2008

Updated

Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attachpath is enabled, allows remote attackers to read arbitrary files via an XML file with a .. (dot dot) in the data element.

Affected Software

18 affected components

Bugzilla=3.1.3

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=2.22.3

Bugzilla=2.23.2

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.23.3

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.6

Bugzilla=3.1.4

Bugzilla=2.4

Bugzilla=2.8

Bugzilla=3.0.2

Bugzilla=2.23

Bugzilla=2.9

Bugzilla=2.22.4

Remediation

Patch Available

http://www.securityfocus.com/bid/30661

Event History

Oct 3, 2008

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4437?

CVE-2008-4437 is classified as a high-severity vulnerability due to its potential to expose sensitive files on the server.

How do I fix CVE-2008-4437?

To fix CVE-2008-4437, upgrade Bugzilla to version 2.22.5 or 3.0.5 or later.

What causes the vulnerability in CVE-2008-4437?

CVE-2008-4437 is caused by a directory traversal vulnerability in the importxml.pl script, allowing attackers to read files outside the intended directory.

Which versions of Bugzilla are affected by CVE-2008-4437?

CVE-2008-4437 affects Bugzilla versions prior to 2.22.5 and 3.x prior to 3.0.5.

Who can exploit CVE-2008-4437?

Remote attackers can exploit CVE-2008-4437 by providing an XML file that includes malicious data using directory traversal sequences.