Directory traversal

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

CVE-2015-9287: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

PT-2019-7246

Name of the Vulnerable Software and Affected Versions mod ucam webauth versions prior to 2.0.2 Description A Directory Traversal issue was discovered, allowing an attacker to manipulate the kid field in the IdP's HTTP response message, specifically the "WLS-Response". The kid field, which should...