PT-2015-7002

Name of the Vulnerable Software and Affected Versions H2O versions prior to 1.4.5 H2O versions 1.5.x prior to 1.5.0-beta2 Description A directory traversal issue allows remote attackers to read arbitrary files via a crafted URL when the file.dir directive is enabled. Recommendations For H2O...

CVE-2015-5638: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL...

H2O vulnerable to directory traversal

Overview H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Yusuke OSUMI reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

h2o -- directory traversal vulnerability

Yakuzo reports: H2O up to version 1.4.4 / 1.5.0-beta1 contains a flaw in its URL normalization logic. When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive. H2O version 1.4.5 and version...