CVE

Id
3368  
CVE No.
CVE-2001-0555  
Status
Candidate  
Description
ScreamingMedia SITEWare versions 2.5 through 3.1 allows a remote attacker to read world-readable files via a .. (dot dot) attack through (1) the SITEWare Editor"s Desktop or (2) the template parameter in SWEditServlet.  
Phase
Modified (20050509)  
Votes
ACCEPT(6) Armstrong, Cole, Foat, Prosser, Stracener, Ziese | MODIFY(1) Frech | NOOP(2) Christey, Wall  
Comments
Christey> ********************************************************************* | Note that this candidate was inadvertently used in Microsoft bulletin | MS01-044, for an unrelated vulnerability. The ScreamingMedia | SITEware problem is the correct vulnerability for | CVE-2001-0555. A different candidate will be used for the problem | described in the Microsoft bulletin. | ********************************************************************* | Frech> XF:siteware-dot-file-retrieval(6689) | Prosser> http://www01.screamingmedia.com/en/security/sms1001.php | Christey> Consider adding BID:3191 | Christey> CHANGEREF CONFIRM:http://www01.screamingmedia.com/en/security/security_notice.php?doc=sms1001 | CERT-VN:VU#795707 | URL:http://www.kb.cert.org/vuls/id/795707 | BID:2869 | URL:http://www.securityfocus.com/bid/2869 | XF:siteware-dot-file-retrieval(6689) | URL:http://xforce.iss.net/static/6689.php | | *DON"T* add BID:3191 - that"s for the Microsoft issue.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
14495 3368 CVE-2001-0555 BUGTRAQ:20010613 ScreamingMedia SITEWare source code disclosure vulnerability  View
14496 3368 CVE-2001-0555 URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0166.html  View
14497 3368 CVE-2001-0555 BUGTRAQ:20010613 ScreamingMedia SITEWare arbitrary file retrieval vulnerability  View
14498 3368 CVE-2001-0555 URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0165.html  View
14499 3368 CVE-2001-0555 CONFIRM:http://www01.screamingmedia.com/en/security/sms1001.php  View
14500 3368 CVE-2001-0555 CERT-VN:VU#795707  View
14501 3368 CVE-2001-0555 URL:http://www.kb.cert.org/vuls/id/795707  View
14502 3368 CVE-2001-0555 BID:2869  View
14503 3368 CVE-2001-0555 URL:http://www.securityfocus.com/bid/2869  View
14504 3368 CVE-2001-0555 OSVDB:13887  View
14505 3368 CVE-2001-0555 URL:http://www.osvdb.org/13887  View
14506 3368 CVE-2001-0555 XF:siteware-dot-file-retrieval(6689)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64154 JVNDB-2001-000128 Microsoft IIS における URL リダイレクトによるサービス運用妨害 (Dos) の脆弱性 Microsoft IIS には、URL のリダイレクトが有効である場合、Code Red ワームの影響を受け、サービス運用妨害 (DoS) 状態が発生する可能性があります。 CVE-2001-0555 3368 10 http://jvndb.jvn.jp/ja/contents/2001/JVNDB-2001-000128.html  View