CVE-2008-2403

2008-06-0420:32:00

CWE-22

mitre

web.nvd.nist.gov

security

directory traversal

vulnerability

sun java asp server

remote attackers

mappath method

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.8

Confidence

Low

EPSS

0.018

Percentile

88.4%

JSON

Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete arbitrary files via a … (dot dot) in the Path parameter to the MapPath method.

Affected configurations

Nvd

Node

sunjava_asp_serverRange≤4.0.2

sunjava_asp_serverMatch4.0

sunjava_asp_serverMatch4.0.1

VendorProductVersionCPE
sunjava_asp_server*cpe:2.3:a:sun:java_asp_server:*:*:*:*:*:*:*:*
sunjava_asp_server4.0cpe:2.3:a:sun:java_asp_server:4.0:*:*:*:*:*:*:*
sunjava_asp_server4.0.1cpe:2.3:a:sun:java_asp_server:4.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sun	java_asp_server	*	cpe:2.3:a:sun:java_asp_server::::::::
sun	java_asp_server	4.0	cpe:2.3:a:sun:java_asp_server:4.0:::::::*
sun	java_asp_server	4.0.1	cpe:2.3:a:sun:java_asp_server:4.0.1:::::::*