CVE-2001-0871 Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request containing (1) a .. in versions 2...
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request containing (1) a .. in versions 2.0 through 2.6.18, or (2) a DOS device name followed by a .. in versions 2.6.19 through 3.0.10.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alchemy lab alchemy eye | = 2.0 | No fix listed |
| alchemy lab alchemy eye | = 2.1 | No fix listed |
| alchemy lab alchemy eye | = 2.2 | No fix listed |
| alchemy lab alchemy eye | = 2.3 | No fix listed |
| alchemy lab alchemy eye | = 2.4 | No fix listed |
| alchemy lab alchemy eye | = 2.5 | No fix listed |
| alchemy lab alchemy eye | = 2.6 | No fix listed |
| alchemy lab alchemy eye | = 2.6.18 | No fix listed |
| alchemy lab alchemy eye | = 2.6.19 | No fix listed |
| alchemy lab alchemy eye | = 3.0 | No fix listed |
| alchemy lab alchemy eye | = 3.0.10 | No fix listed |
| dek software alchemy network monitor | <= 3.0.10 | No fix listed |
References
- 20011129 Rapid 7 Advisory R7-0001: Alchemy Eye HTTP Remote Command Execution mailing-list
- VU#220715 third-party-advisory us-government-resource
- 3599 vdb-entry vendor-advisory
- alchemy-http-dot-commands(7625) vdb-entry
- alchemy-http-dot-variant(7626) vdb-entry