CVE-2008-0466
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.
Does this matter?
Lower severity and a low EPSS score (4.93%). Track it; it rarely justifies an emergency change on its own.
Description
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 4.93% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- webwiz/web wiz forums · webwiz/web wiz newspad · webwiz/web wiz rich text editor
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/3584
- http://securitytracker.com/id?1019267
- http://www.bugreport.ir/?/29
- http://www.bugreport.ir/?/31
- http://www.securityfocus.com/archive/1/486866/100/0/threaded
- http://www.securityfocus.com/archive/1/486868/100/0/threaded
- http://www.securityfocus.com/bid/27419
- http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp
- https://www.exploit-db.com/exploits/4970
- https://www.exploit-db.com/exploits/4971
- http://securityreason.com/securityalert/3584
- http://securitytracker.com/id?1019267
- http://www.bugreport.ir/?/29
- http://www.bugreport.ir/?/31
- http://www.securityfocus.com/archive/1/486866/100/0/threaded
- http://www.securityfocus.com/archive/1/486868/100/0/threaded
- http://www.securityfocus.com/bid/27419
- http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp
- https://www.exploit-db.com/exploits/4970
- https://www.exploit-db.com/exploits/4971
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.