CVE-2007-6317
Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..\ (dot dot backslash) sequences in the URL path, or (2) remote authenticated users to delete arbitrary…
Does this matter?
Lower severity and a low EPSS score (6.04%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..\ (dot dot backslash) sequences in the URL path, or (2) remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ (dot dot backslash) sequence in the dir parameter to /drive/c/bdusers/USER/.
- CVSS 2.0
- 5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
- EPSS
- 6.04% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- real time logic/barracudadrive web server · real time logic/barracudadrive web server home server
- Source
- cve@mitre.org
References
- http://aluigi.altervista.org/adv/barradrive-adv.txtExploit
- http://secunia.com/advisories/28032Vendor Advisory
- http://securityreason.com/securityalert/3434
- http://www.securityfocus.com/archive/1/484833/100/0/threaded
- http://www.securityfocus.com/bid/26805Exploit, Patch
- http://aluigi.altervista.org/adv/barradrive-adv.txtExploit
- http://secunia.com/advisories/28032Vendor Advisory
- http://securityreason.com/securityalert/3434
- http://www.securityfocus.com/archive/1/484833/100/0/threaded
- http://www.securityfocus.com/bid/26805Exploit, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.