6.8 Medium
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.01 Low
EPSS
Percentile
83.7%
Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a … (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a … (dot dot) in an account name, when requesting a URI composed of a “/?%0a” sequence followed by the data.
CPE | Name | Operator | Version |
---|---|---|---|
hfs:http_file_server | hfs http file server | le | 2.2b |
secunia.com/advisories/28631
securityreason.com/securityalert/3581
www.rejetto.com/hfs/?f=wn
www.securityfocus.com/archive/1/486873/100/0/threaded
www.securityfocus.com/bid/27423
www.syhunt.com/advisories/hfs-1-log.txt
www.syhunt.com/advisories/hfshack.txt
exchange.xforce.ibmcloud.com/vulnerabilities/39873