CVE-2012-1050

mathopd 1.4.x-1.5.x < 1.5p7 - Path Traversal via Host Header

Title source: llm

Description

Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header.

References (7)

Core 7

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/47908

Broken Link mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2012-02/0025.html

Third Party Advisory mailing-list x_refsource_mlist

http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1026641

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/73049

Vendor Advisory x_refsource_confirm

http://www.mathopd.org/security.html

Broken Link vdb-entry x_refsource_osvdb

http://osvdb.org/78896

Scores

EPSS 0.0347

EPSS Percentile 87.6%

Details

CWE

CWE-22

Status published

Products (2)

mathopd/mathopd 1.5 p5

mathopd/mathopd 1.4 - 1.5

Published Feb 13, 2012

Tracked Since Feb 18, 2026