VulnerabilityModified
CVE-2002-0196
GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.
MEDIUM 6.4EPSS 1.57%
Does this matter?
Lower severity and a low EPSS score (1.57%). Track it; it rarely justifies an emergency change on its own.
Description
GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.57% probability · 74th percentile
- CISA KEV
- Not listed
- Affected
- acd incorporated/cwpapi
- Source
- cve@mitre.org
References
- http://online.securityfocus.com/archive/1/251699
- http://sourceforge.net/forum/forum.php?forum_id=144966Patch
- http://www.iss.net/security_center/static/7981.phpPatch, Vendor Advisory
- http://www.securityfocus.com/bid/3924
- http://online.securityfocus.com/archive/1/251699
- http://sourceforge.net/forum/forum.php?forum_id=144966Patch
- http://www.iss.net/security_center/static/7981.phpPatch, Vendor Advisory
- http://www.securityfocus.com/bid/3924
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.