CVE-2003-1413

Darwin Streaming Server 4.1.1 - Path Traversal via parse_xml.cgi Filename Parameter

Title source: llm
STIX 2.1

Description

parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3260
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/313517
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/11445
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/6992

Scores

EPSS 0.0121
EPSS Percentile 64.7%

Details

CWE
CWE-22
Status published
Products (2)
apple/darwin_streaming_server 4.1.2
apple/quicktime_streaming_server 4.1.1
Published Dec 31, 2003
Tracked Since Feb 18, 2026