VulnerabilityModified
CVE-2007-4756
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename.
MEDIUM 6.8EPSS 3.64%
Does this matter?
Lower severity and a low EPSS score (3.64%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename. NOTE: the "..\" are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.64% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- ghisler/total commander
- Source
- cve@mitre.org
References
- http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt
- http://osvdb.org/39838
- http://secunia.com/advisories/26734Vendor Advisory
- http://securityreason.com/securityalert/3106
- http://www.ghisler.com/whatsnew.htmPatch
- http://www.securityfocus.com/archive/1/478720/100/0/threaded
- http://www.securityfocus.com/bid/25581Exploit
- http://www.securitytracker.com/id?1018662
- http://www.vupen.com/english/advisories/2007/3102
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36486
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36487
- http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt
- http://osvdb.org/39838
- http://secunia.com/advisories/26734Vendor Advisory
- http://securityreason.com/securityalert/3106
- http://www.ghisler.com/whatsnew.htmPatch
- http://www.securityfocus.com/archive/1/478720/100/0/threaded
- http://www.securityfocus.com/bid/25581Exploit
- http://www.securitytracker.com/id?1018662
- http://www.vupen.com/english/advisories/2007/3102
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36486
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36487
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.