VulnerabilityModified

CVE-2011-4450

Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial ..

MEDIUM 6.4EPSS 7.48%

Does this matter?

Lower severity and a low EPSS score (7.48%). Track it; it rarely justifies an emergency change on its own.

Description

Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action.

CVSS 2.0: 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
EPSS: 7.48% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: wikkawiki/wikkawiki
Source: cve@mitre.org

References

http://wush.net/trac/wikka/changeset/1828Exploit, Patch
http://wush.net/trac/wikka/ticket/1097
http://wush.net/trac/wikka/changeset/1828Exploit, Patch
http://wush.net/trac/wikka/ticket/1097

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.