Lucene search

MitreCVE-2008-2702

HistoryJun 13, 2008 - 7:41 p.m.

CVE-2008-2702

2008-06-1319:41:00

CWE-22

mitre

web.nvd.nist.gov

altools

estsoft

alftp

directory traversal

ftp client

remote code execution

cve-2008-2702

vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

Confidence

Low

EPSS

0.002

Percentile

60.0%

JSON

Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary files via a … (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Affected configurations

Nvd

Node

estsoftalftpMatch4.1beta2en

estsoftalftpMatch5.0ko

VendorProductVersionCPE
estsoftalftp4.1cpe:2.3:a:estsoft:alftp:4.1:beta2:*:en:*:*:*:*
estsoftalftp5.0cpe:2.3:a:estsoft:alftp:5.0:*:*:ko:*:*:*:*

Vendor	Product	Version	CPE
estsoft	alftp	4.1	cpe:2.3:a:estsoft:alftp:4.1:beta2::en::::*
estsoft	alftp	5.0	cpe:2.3:a:estsoft:alftp:5.0:::ko::::

References

secunia.com/advisories/30559

vuln.sg/alftp41b2-en.html

www.securityfocus.com/bid/29585

www.vupen.com/english/advisories/2008/1763/references

exchange.xforce.ibmcloud.com/vulnerabilities/42900

Social References

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

Confidence

Low

EPSS

0.002

Percentile

60.0%

JSON

Related for CVE-2008-2702