CVE-2008-0405

HTTP File Server < 2.2b - Path Traversal and Arbitrary File Write via Account Name

Title source: llm
STIX 2.1

Description

Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name, when requesting a URI composed of a "/?%0a" sequence followed by the data.

References (8)

Core 8
Core References
Exploit x_refsource_misc
http://www.rejetto.com/hfs/?f=wn
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/27423
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3581
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/486873/100/0/threaded
Various Sources x_refsource_misc
http://www.syhunt.com/advisories/hfs-1-log.txt
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28631
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/39873

Scores

EPSS 0.0307
EPSS Percentile 86.1%

Details

CWE
CWE-22
Status published
Products (1)
hfs/http_file_server < 2.2b
Published Jan 29, 2008
Tracked Since Feb 18, 2026