CVE-2008-0466

Webwiz Web Wiz Forums - Authentication Bypass

Title source: rule
STIX 2.1

Description

Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.

Exploits (2)

exploitdb WRITEUP VERIFIED
by BugReport.IR · textwebappsasp
https://www.exploit-db.com/exploits/4971
exploitdb WRITEUP VERIFIED
by BugReport.IR · textwebappsasp
https://www.exploit-db.com/exploits/4970

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/486868/100/0/threaded
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/4970
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/4971
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/27419
Various Sources x_refsource_misc
http://www.bugreport.ir/?/29
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3584
Various Sources x_refsource_misc
http://www.bugreport.ir/?/31
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1019267
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/486866/100/0/threaded

Scores

EPSS 0.1228
EPSS Percentile 93.9%

Details

CWE
CWE-287
Status published
Products (3)
webwiz/web_wiz_forums 9.07
webwiz/web_wiz_newspad 1.02
webwiz/web_wiz_rich_text_editor 4.0
Published Jan 29, 2008
Tracked Since Feb 18, 2026