CVE Vulnerability

CVE-2007-0888

Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://www.kiwisyslog.com/kb/idx/5/178/article/
http://www.securityfocus.com/bid/22490
http://www.osvdb.org/33162
http://secunia.com/advisories/24103
http://securityreason.com/securityalert/2236
http://www.vupen.com/english/advisories/2007/0536
https://exchange.xforce.ibmcloud.com/vulnerabilities/32398
http://www.securityfocus.com/archive/1/459933/100/0/threaded
http://www.securityfocus.com/archive/1/459500/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:kiwi_enterprises:kiwi_cattools:*:*:*:*:*:*:*:*
Information

Published : 2007-02-12 11:28

Updated : 2018-10-16 04:35

NVD link : CVE-2007-0888

Mitre link : CVE-2007-0888

Products Affected
No products.
CWE
NVD-CWE-Other