VulnerabilityModified
CVE-2004-0465
Directory traversal vulnerability in jretest.html in WebConnect 6.5 and 6.4.4, and possibly earlier versions, allows remote attackers to read keys within arbitrary INI formatted files via "..//" sequences in the WCP_USER parameter.
MEDIUM 5.0EPSS 12.3%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in jretest.html in WebConnect 6.5 and 6.4.4, and possibly earlier versions, allows remote attackers to read keys within arbitrary INI formatted files via "..//" sequences in the WCP_USER parameter.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 12.25% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- openconnect/webconnect
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=110910838600145&w=2
- http://secunia.com/advisories/14006/Patch
- http://www.cirt.dk/advisories/cirt-29-advisory.pdfExploit, Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/628411Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/JSHA-69HVPKThird Party Advisory, US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19394
- http://marc.info/?l=bugtraq&m=110910838600145&w=2
- http://secunia.com/advisories/14006/Patch
- http://www.cirt.dk/advisories/cirt-29-advisory.pdfExploit, Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/628411Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/JSHA-69HVPKThird Party Advisory, US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19394
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.