CVE-2002-0196 GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in othe...
MediumCVSS 6.4
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| acd incorporated cwpapi | = 1.1 | No fix listed |
References
- 20020122 (Repost) CwpApi : GetRelativePath() returns invalid paths (security advisory) mailing-list
- sourceforge.net patch
- cwpapi-getrelativepath-view-files(7981) patch vdb-entry vendor-advisory
- 3924 vdb-entry